This threat involves a malicious code injection into the @redhat-cloud-services/config-manager-client npm package (versions 5.0.4, 5.0.5, and 5.0.7) as part of the "Mini Shai-Hulud" supply chain worm campaign. The attacker compromised the GitHub Actions OIDC trusted publisher shared by Red Hat Cloud Services npm packages to insert a preinstall hook that executes a three-layer obfuscated payload. This payload downloads a pinned Bun runtime to execute the worm outside the Node environment. The malware harvests extensive credentials from AWS, Azure, GCP, HashiCorp Vault, Kubernetes, GitHub, npm, various CI platforms, password managers, and local files, exfiltrating them to public GitHub repositories controlled by the attacker. It escalates privileges by exploiting Docker socket access to escape containers and modify sudoers files for passwordless sudo access. The worm self-propagates by republishing tampered npm packages using stolen credentials and injecting malicious CodeQL workflows into GitHub repositories, signing artifacts with Sigstore to appear legitimate. Persistence is maintained via daemon installation and hijacking of AI agent and editor configurations. The malware detects sandbox environments and probes for EDR tools to evade detection. Due to the full compromise risk, all secrets must be rotated, and the package removed, though removal may not eliminate all malicious components.

The impact includes full system compromise where the package is installed or running. The attacker gains access to a wide range of sensitive credentials across multiple cloud providers, CI/CD platforms, password managers, and local files, enabling further unauthorized access and lateral movement. Privilege escalation allows the attacker to gain passwordless sudo access, increasing control over the host environment. The worm self-propagates by republishing malicious packages and injecting workflows into GitHub repositories, potentially compromising additional systems and supply chains. Persistence and evasion techniques make detection and removal difficult, increasing the risk of long-term undetected compromise.

No official patch or fix is indicated in the provided data. Systems with the affected package versions (=5.0.4, =5.0.5, =5.0.7) should consider themselves fully compromised. Immediate removal of the package is recommended, but this alone may not remove all malicious components. All secrets and credentials stored on the compromised system must be rotated immediately from a different, secure machine. Monitor for indicators of compromise related to this threat and consider forensic analysis to identify persistence mechanisms. Follow vendor advisories if they become available for official remediation guidance.