# Miasma: @redhat-cloud-services Mini Shai-Hulud worm compromises 32 npm packages in 72 seconds > On 2026-06-01 an attacker published malicious versions of 32 `@redhat-cloud-services/*` npm packages in a 72-second window. The "Miasma" payload - a reskinned Mini Shai-Hulud worm - drops a preinstall script that runs a Bun-loaded credential stealer, harvests AWS/GCP/Azure/Kubernetes/Vault/GitHub/npm tokens, and exfiltrates to attacker-controlled GitHub repos tagged `Miasma: The Spreading Blight`. - Published: 2026-06-01 - Severity: critical - Kind: Compromise - A legitimate, already-used package, maintainer account, CI pipeline, or release tag was hijacked and a malicious version was published under a name people already depend on. - Ecosystems: npm - Scope: 32 packages, 95 compromised versions - Tags: worm, credential-theft, ci-cd-compromise, maintainer-takeover, obfuscation, account-takeover - Threat actor: TeamPCP - Also known as: Miasma, Miasma: The Spreading Blight, Mini Shai-Hulud - Detected by: Wiz, ReversingLabs, JFrog, StepSecurity, Snyk, Mend, Aikido, SafeDep - Incident ID: npm-2026-06-01-miasma-redhat-cloud-services ## Affected packages (32) Only the exact versions listed were named by the source advisories. Other versions are not implicated. | Package | Ecosystem | Compromised versions | |---|---|---| | [@redhat-cloud-services/chrome](https://dependencywatch.io/package/npm/@redhat-cloud-services/chrome) | npm | 2.3.1, 2.3.2, 2.3.4 | | [@redhat-cloud-services/compliance-client](https://dependencywatch.io/package/npm/@redhat-cloud-services/compliance-client) | npm | 4.0.3, 4.0.4, 4.0.6 | | [@redhat-cloud-services/config-manager-client](https://dependencywatch.io/package/npm/@redhat-cloud-services/config-manager-client) | npm | 5.0.4, 5.0.5, 5.0.7 | | [@redhat-cloud-services/entitlements-client](https://dependencywatch.io/package/npm/@redhat-cloud-services/entitlements-client) | npm | 4.0.11, 4.0.12, 4.0.14 | | [@redhat-cloud-services/eslint-config-redhat-cloud-services](https://dependencywatch.io/package/npm/@redhat-cloud-services/eslint-config-redhat-cloud-services) | npm | 3.2.1, 3.2.2, 3.2.4 | | [@redhat-cloud-services/frontend-components](https://dependencywatch.io/package/npm/@redhat-cloud-services/frontend-components) | npm | 7.7.2, 7.7.3, 7.7.5 | | [@redhat-cloud-services/frontend-components-advisor-components](https://dependencywatch.io/package/npm/@redhat-cloud-services/frontend-components-advisor-components) | npm | 3.8.2, 3.8.4, 3.8.6 | | [@redhat-cloud-services/frontend-components-config](https://dependencywatch.io/package/npm/@redhat-cloud-services/frontend-components-config) | npm | 6.11.3, 6.11.4, 6.11.6 | | [@redhat-cloud-services/frontend-components-config-utilities](https://dependencywatch.io/package/npm/@redhat-cloud-services/frontend-components-config-utilities) | npm | 4.11.2, 4.11.3, 4.11.5 | | [@redhat-cloud-services/frontend-components-notifications](https://dependencywatch.io/package/npm/@redhat-cloud-services/frontend-components-notifications) | npm | 6.9.2, 6.9.3, 6.9.5 | | [@redhat-cloud-services/frontend-components-remediations](https://dependencywatch.io/package/npm/@redhat-cloud-services/frontend-components-remediations) | npm | 4.9.2, 4.9.3, 4.9.5 | | [@redhat-cloud-services/frontend-components-testing](https://dependencywatch.io/package/npm/@redhat-cloud-services/frontend-components-testing) | npm | 1.2.1, 1.2.2, 1.2.4 | | [@redhat-cloud-services/frontend-components-translations](https://dependencywatch.io/package/npm/@redhat-cloud-services/frontend-components-translations) | npm | 4.4.1, 4.4.2, 4.4.4 | | [@redhat-cloud-services/frontend-components-utilities](https://dependencywatch.io/package/npm/@redhat-cloud-services/frontend-components-utilities) | npm | 7.4.1, 7.4.2, 7.4.4 | | [@redhat-cloud-services/hcc-feo-mcp](https://dependencywatch.io/package/npm/@redhat-cloud-services/hcc-feo-mcp) | npm | 0.3.1, 0.3.2, 0.3.4 | | [@redhat-cloud-services/hcc-kessel-mcp](https://dependencywatch.io/package/npm/@redhat-cloud-services/hcc-kessel-mcp) | npm | 0.3.1, 0.3.2, 0.3.4 | | [@redhat-cloud-services/hcc-pf-mcp](https://dependencywatch.io/package/npm/@redhat-cloud-services/hcc-pf-mcp) | npm | 0.6.1, 0.6.2, 0.6.4 | | [@redhat-cloud-services/host-inventory-client](https://dependencywatch.io/package/npm/@redhat-cloud-services/host-inventory-client) | npm | 5.0.3, 5.0.4, 5.0.6 | | [@redhat-cloud-services/insights-client](https://dependencywatch.io/package/npm/@redhat-cloud-services/insights-client) | npm | 4.0.4, 4.0.5, 4.0.7 | | [@redhat-cloud-services/integrations-client](https://dependencywatch.io/package/npm/@redhat-cloud-services/integrations-client) | npm | 6.0.4, 6.0.5, 6.0.7 | | [@redhat-cloud-services/javascript-clients-shared](https://dependencywatch.io/package/npm/@redhat-cloud-services/javascript-clients-shared) | npm | 2.0.8, 2.0.9, 2.0.11 | | [@redhat-cloud-services/notifications-client](https://dependencywatch.io/package/npm/@redhat-cloud-services/notifications-client) | npm | 6.1.4, 6.1.5, 6.1.7 | | [@redhat-cloud-services/patch-client](https://dependencywatch.io/package/npm/@redhat-cloud-services/patch-client) | npm | 4.0.4, 4.0.5, 4.0.7 | | [@redhat-cloud-services/quickstarts-client](https://dependencywatch.io/package/npm/@redhat-cloud-services/quickstarts-client) | npm | 4.0.11, 4.0.12, 4.0.14 | | [@redhat-cloud-services/rbac-client](https://dependencywatch.io/package/npm/@redhat-cloud-services/rbac-client) | npm | 9.0.3, 9.0.4, 9.0.6 | | [@redhat-cloud-services/remediations-client](https://dependencywatch.io/package/npm/@redhat-cloud-services/remediations-client) | npm | 4.0.4, 4.0.5, 4.0.7 | | [@redhat-cloud-services/rule-components](https://dependencywatch.io/package/npm/@redhat-cloud-services/rule-components) | npm | 4.7.2, 4.7.3, 4.7.5 | | [@redhat-cloud-services/sources-client](https://dependencywatch.io/package/npm/@redhat-cloud-services/sources-client) | npm | 3.0.10, 3.0.11, 3.0.13 | | [@redhat-cloud-services/topological-inventory-client](https://dependencywatch.io/package/npm/@redhat-cloud-services/topological-inventory-client) | npm | 3.0.10, 3.0.11, 3.0.13 | | [@redhat-cloud-services/tsc-transform-imports](https://dependencywatch.io/package/npm/@redhat-cloud-services/tsc-transform-imports) | npm | 1.2.2, 1.2.4, 1.2.6 | | [@redhat-cloud-services/types](https://dependencywatch.io/package/npm/@redhat-cloud-services/types) | npm | 3.6.1, 3.6.2, 3.6.4 | | [@redhat-cloud-services/vulnerabilities-client](https://dependencywatch.io/package/npm/@redhat-cloud-services/vulnerabilities-client) | npm | 2.1.9, 2.1.11 | ## What happened On 2026-06-01, Wiz Research observed a single attacker publish 32 malicious versions across 32 `@redhat-cloud-services/*` npm packages inside a 72-second window. ReversingLabs and JFrog independently confirmed the burst. Each malicious version is sandwiched between two clean releases - e.g. `@redhat-cloud-services/frontend-components-utilities` has compromised `7.4.1`, `7.4.2`, `7.4.4` published alongside benign versions, making "pin to latest" a brittle remediation. In total 96 versions across 32 packages were poisoned, with the affected set cumulatively pulling ~117k downloads/week and ~9.8M downloads lifetime. The attack vector was a compromised Red Hat employee GitHub account, used to push orphan commits directly to two `RedHatInsights` repositories and to trigger GitHub Actions OIDC publish to npm - bypassing code review entirely. The Red Hat npm scope token itself was not stolen; this was a CI/CD-trust compromise, the same class of bug as the 2026-05-11 TanStack burst but executed against a different organisation. ## Payload - "Miasma: The Spreading Blight" Each malicious tarball ships a `preinstall` hook that runs immediately on `npm install`. The hook decrypts and writes two artefacts: `_b` (a ~898-byte Bun-runtime bootstrapper) and `_p` (a ~620 KB credential stealer). The payload is a lightly-reskinned descendant of the **Mini Shai-Hulud** worm that TeamPCP open-sourced in late April 2026 - same Bun-runtime architecture and same stealer modules used in the SAP `@cap-js` (April), TanStack (2026-05-11), `@antv` (2026-05-19) and `durabletask` (2026-05-19) compromises, plus *new* GCP/Azure identity collectors that enumerate every cloud identity the infected host can assume. The stealer encrypts each exfil envelope with a per-session AES-256-GCM key, RSA-OAEP-wraps the key with the attacker public key, and POSTs to `https://api.anthropic.com:443/v1/api` (a decoy hostname encoded in the payload) as its primary channel. The GitHub-API fallback channel commits the same envelope as a file to attacker-owned public repos and labels each victim repo with the description `Miasma: The Spreading Blight` - IOC table samples include the AES-128-GCM keys `fe0d71d57ecf4fa0a433185bf59a03f5` and `f5e5dca9b725ec18514c4b322ed35d2b`. One commit message variant taunts the victim: `IfYouInvalidateThisTokenItWillNukeTheComputerOfTheOwner:`. ## Worm behaviour After exfiltration the stealer enumerates the npm scopes the stolen publish tokens can write to, re-uses the same preinstall structure to publish further malicious versions, and registers a new attacker GitHub repo for each victim - the worm therefore self-spreads via the same trust path that TeamPCP used in the TanStack burst. StepSecurity, Snyk, Mend, ReversingLabs and JFrog all flagged the campaign within hours; npm pulled most malicious versions the same day, but cached copies in CI images, Artifactory mirrors and lockfiles remain in scope for audit. ## Impact - Preinstall lifecycle hook runs a 4.2 MB obfuscated payload before any application code on every `npm install` of an affected version - Cloud credential theft: AWS (IMDS/ECS task role/Secrets Manager), Azure managed identity, GCP metadata service, Kubernetes service-account tokens - CI/CD secret theft: GitHub Actions OIDC token, `GITHUB_TOKEN`, npm publish tokens, CircleCI tokens, HashiCorp Vault tokens - Worm propagation: stolen npm tokens are used to publish further compromised versions to other scopes the victim can write to - Persistence: malware creates a public GitHub repo on each victim describing itself as "Miasma: The Spreading Blight" - used both as a beacon and as a fallback exfiltration channel - Anti-EDR: payload probes for CrowdStrike, SentinelOne, Carbon Black, and StepSecurity Harden-Runner before activating, and is per-package AES-128-GCM encrypted to defeat hash-based IOC matching - @redhat-cloud-services frontend-components & API clients ship in the Red Hat Hybrid Cloud Console UI - any internal Red Hat tooling or customer portal that rebuilt on 2026-06-01 pulled a malicious version ## What to do 1. Audit every `package.json` / lockfile / CI image cache for any `@redhat-cloud-services/*` version listed in the packages map below - the malicious versions were sandwiched between two clean releases per package, so simply "upgrading to latest" is sufficient *only* if you skip the 3 affected versions 2. Run `npm ci --ignore-scripts` (or pnpm/yarn equivalents) for any CI build that does not need lifecycle scripts, and review any new preinstall hook in PRs 3. Rotate every secret reachable from any host or runner that installed an affected version on or after 2026-06-01: AWS keys + ECS task role + Secrets Manager entries, GCP service-account keys, Azure managed-identity tokens, Kubernetes service-account tokens, HashiCorp Vault tokens, GitHub PATs + Actions OIDC trust, npm publish tokens 4. Hunt outbound HTTPS POST to `api.anthropic.com/v1/api` (decoy domain encoded into the payload) and GitHub API writes from build hosts to repos with description `Miasma: The Spreading Blight` 5. Search GitHub Audit Log for new public repos created from compromised PATs with that description 6. Search npm token usage history for unexpected publishes between 2026-06-01 and the date the relevant token was rotated 7. Block the malicious version ranges in your private mirror / Artifactory / Nexus so cached copies cannot be served ## Check your own dependencies - Check a package-lock.json against this incident: https://dependencywatch.io/check/package-lock-json The scan runs entirely in the browser; lockfile contents are never uploaded. ## References - [Miasma: Supply Chain Attack Targeting RedHat npm Packages](https://www.wiz.io/blog/miasma-supply-chain-attack-targeting-redhat-npm-packages) - Wiz - [[SECURITY] Malicious npm releases detected across @redhat-cloud-services scope](https://github.com/RedHatInsights/javascript-clients/issues/492) - RedHatInsights - [RHSB-2026-006 Supply chain compromise of @redhat-cloud-services npm packages](https://access.redhat.com/security/vulnerabilities/RHSB-2026-006) - Red Hat Product Security - [32 Red Hat npm packages backdoored in 72 seconds](https://www.reversinglabs.com/blog/red-hat-cloud-service-npm-packages-backdoored-in-72-seconds) - ReversingLabs - [Shai-Hulud - Miasma: The Spreading Blight hits Red Hat npm packages](https://research.jfrog.com/post/shai-hulud-miasma-redhat-cloud-services/) - JFrog - [Multiple redhat-cloud-services npm packages compromised](https://www.stepsecurity.io/blog/multiple-redhat-cloud-services-npm-packages-compromised) - StepSecurity - [Miasma attack hits Red Hat npm packages](https://snyk.io/blog/miasma-supply-chain-attack-malicious-code-redhat-cloud-services-npm-packages/) - Snyk - [Miasma supply chain attack compromises Red Hat npm packages with credential-stealing worm](https://thehackernews.com/2026/06/miasma-supply-chain-attack-compromises.html) - The Hacker News - [Red Hat npm packages compromised to steal developer credentials](https://www.bleepingcomputer.com/news/security/red-hat-npm-packages-compromised-to-steal-developer-credentials/) - BleepingComputer --- Canonical page: https://dependencywatch.io/incident/npm-2026-06-01-miasma-redhat-cloud-services Markdown version: https://dependencywatch.io/incident/npm-2026-06-01-miasma-redhat-cloud-services.md Site index for agents: https://dependencywatch.io/llms.txt DependencyWatch.io is operated by Precursor Security (https://precursorsecurity.com).