Malicious code in @redhat-cloud-services/frontend-components-utilities (npm)
Part of the "Mini Shai-Hulud" supply chain worm campaign that compromised the GitHub Actions OIDC trusted publisher shared by Red Hat Cloud Services npm packages. The attacker injected a `preinstall` hook into this and 31 other packages in the `@redhat-cloud-services` scope. The hook delivers a three-layer obfuscated payload (ROT-9 Caesar cipher over a 1.27M-entry character-code array -> AES-128-GCM decryption with hardcoded keys -> stacked obfuscator.io encoding with PBKDF2+SHA-256 keystream S-box substitution) that downloads a pinned Bun runtime (v1.3.13) from GitHub to execute the worm outside the victim's Node installation. **Credential theft:** Harvests AWS credentials (IMDS, ECS, Secrets Manager, SSM), Azure managed identities, GCP service account tokens, HashiCorp Vault tokens, Kubernetes service account tokens (`/var/run/secrets/kubernetes.io/serviceaccount/token`), GitHub PATs, npm publish tokens, environment variables from ~40 CI platforms (CircleCI, Travis CI, Jenkins, and others), password manager stores (Bitwarden, gopass), and local files (`~/.npmrc`, `~/.netrc`, shell history, database history). Collected data is exfiltrated to attacker-controlled public GitHub repositories. **Privilege escalation:** Exploits Docker socket access to escape containers and modify `/etc/sudoers.d`, granting passwordless sudo to CI runner user accounts. **Self-propagation:** Uses stolen npm credentials to republish tampered tarballs of target packages. Injects a malicious CodeQL workflow into accessible GitHub repositories via the GraphQL `createCommitOnBranch` mutation, exchanges GitHub Actions OIDC tokens for npm publish tokens, and signs the resulting artifacts through Sigstore (Fulcio/Rekor) to appear legitimate. **Persistence and evasion:** Installs a daemon at `/tmp/kitty-<random>`, hijacks `.claude/settings.json` for AI agent persistence, and hijacks `.vscode/tasks.json` for editor task execution. Detects sandbox environments via `__FAKE_PLATFORM__`, `TESTING_TAR_FAKE_PLATFORM__`, and `__IS_DAEMON` environment variables, and probes for EDR tools (CrowdStrike, SentinelOne, Carbon Black, StepSecurity Harden-Runner). --- _-= Per source details. Do not edit below this line.=-_ ## Source: ghsa-malware (487b1a50ed4af81c3fdbd1786feb85dd5e2b1b7394dd4b2615c8390090c27b53) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
AI Analysis
Technical Summary
This threat involves malicious code injected into the @redhat-cloud-services/frontend-components-utilities npm package (versions 7.4.1, 7.4.2, and 7.4.4) as part of a supply chain worm campaign targeting Red Hat Cloud Services packages. The attacker added a preinstall hook delivering a three-layer obfuscated payload that downloads a pinned Bun runtime to execute the worm outside the Node environment. The malware harvests a broad spectrum of credentials including AWS, Azure, GCP, HashiCorp Vault, Kubernetes tokens, GitHub PATs, npm tokens, environment variables from ~40 CI platforms, password manager stores, and local sensitive files. It escalates privileges by exploiting Docker socket access to gain passwordless sudo on CI runner accounts. The worm self-propagates by republishing malicious package versions using stolen npm credentials and injecting malicious CodeQL workflows into GitHub repositories via GraphQL mutations. It also signs artifacts with Sigstore to appear legitimate. Persistence is maintained via daemon installation and hijacking of AI agent and editor configuration files. The malware detects sandbox environments and probes for EDR tools to evade detection. Systems with this package installed should be treated as fully compromised.
Potential Impact
The impact includes full system compromise on any computer with the affected package installed or running. The attacker gains access to a wide range of sensitive credentials across multiple cloud providers, CI platforms, password managers, and local files, enabling extensive credential theft. Privilege escalation via Docker socket exploitation allows the attacker to gain passwordless sudo access, increasing control over the system. The malware self-propagates by republishing malicious packages and injecting workflows into GitHub repositories, expanding the attack surface. Persistence mechanisms and evasion techniques reduce the likelihood of detection and removal. Overall, this leads to severe confidentiality, integrity, and availability risks.
Mitigation Recommendations
No official patch or fix is currently documented for this malicious package compromise. Immediate mitigation requires removing the affected package versions (=7.4.1, =7.4.2, =7.4.4) from all systems. However, removal alone does not guarantee eradication due to persistence mechanisms. All secrets and credentials potentially exposed should be rotated immediately from a secure, uncompromised environment. Monitor for suspicious activity related to npm publishing, GitHub workflows, and privilege escalations. Review and harden Docker socket access controls to prevent container escape. Follow vendor advisories and security community updates for any forthcoming official remediation or guidance.
Malicious code in @redhat-cloud-services/frontend-components-utilities (npm)
Description
Part of the "Mini Shai-Hulud" supply chain worm campaign that compromised the GitHub Actions OIDC trusted publisher shared by Red Hat Cloud Services npm packages. The attacker injected a `preinstall` hook into this and 31 other packages in the `@redhat-cloud-services` scope. The hook delivers a three-layer obfuscated payload (ROT-9 Caesar cipher over a 1.27M-entry character-code array -> AES-128-GCM decryption with hardcoded keys -> stacked obfuscator.io encoding with PBKDF2+SHA-256 keystream S-box substitution) that downloads a pinned Bun runtime (v1.3.13) from GitHub to execute the worm outside the victim's Node installation. **Credential theft:** Harvests AWS credentials (IMDS, ECS, Secrets Manager, SSM), Azure managed identities, GCP service account tokens, HashiCorp Vault tokens, Kubernetes service account tokens (`/var/run/secrets/kubernetes.io/serviceaccount/token`), GitHub PATs, npm publish tokens, environment variables from ~40 CI platforms (CircleCI, Travis CI, Jenkins, and others), password manager stores (Bitwarden, gopass), and local files (`~/.npmrc`, `~/.netrc`, shell history, database history). Collected data is exfiltrated to attacker-controlled public GitHub repositories. **Privilege escalation:** Exploits Docker socket access to escape containers and modify `/etc/sudoers.d`, granting passwordless sudo to CI runner user accounts. **Self-propagation:** Uses stolen npm credentials to republish tampered tarballs of target packages. Injects a malicious CodeQL workflow into accessible GitHub repositories via the GraphQL `createCommitOnBranch` mutation, exchanges GitHub Actions OIDC tokens for npm publish tokens, and signs the resulting artifacts through Sigstore (Fulcio/Rekor) to appear legitimate. **Persistence and evasion:** Installs a daemon at `/tmp/kitty-<random>`, hijacks `.claude/settings.json` for AI agent persistence, and hijacks `.vscode/tasks.json` for editor task execution. Detects sandbox environments via `__FAKE_PLATFORM__`, `TESTING_TAR_FAKE_PLATFORM__`, and `__IS_DAEMON` environment variables, and probes for EDR tools (CrowdStrike, SentinelOne, Carbon Black, StepSecurity Harden-Runner). --- _-= Per source details. Do not edit below this line.=-_ ## Source: ghsa-malware (487b1a50ed4af81c3fdbd1786feb85dd5e2b1b7394dd4b2615c8390090c27b53) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This threat involves malicious code injected into the @redhat-cloud-services/frontend-components-utilities npm package (versions 7.4.1, 7.4.2, and 7.4.4) as part of a supply chain worm campaign targeting Red Hat Cloud Services packages. The attacker added a preinstall hook delivering a three-layer obfuscated payload that downloads a pinned Bun runtime to execute the worm outside the Node environment. The malware harvests a broad spectrum of credentials including AWS, Azure, GCP, HashiCorp Vault, Kubernetes tokens, GitHub PATs, npm tokens, environment variables from ~40 CI platforms, password manager stores, and local sensitive files. It escalates privileges by exploiting Docker socket access to gain passwordless sudo on CI runner accounts. The worm self-propagates by republishing malicious package versions using stolen npm credentials and injecting malicious CodeQL workflows into GitHub repositories via GraphQL mutations. It also signs artifacts with Sigstore to appear legitimate. Persistence is maintained via daemon installation and hijacking of AI agent and editor configuration files. The malware detects sandbox environments and probes for EDR tools to evade detection. Systems with this package installed should be treated as fully compromised.
Potential Impact
The impact includes full system compromise on any computer with the affected package installed or running. The attacker gains access to a wide range of sensitive credentials across multiple cloud providers, CI platforms, password managers, and local files, enabling extensive credential theft. Privilege escalation via Docker socket exploitation allows the attacker to gain passwordless sudo access, increasing control over the system. The malware self-propagates by republishing malicious packages and injecting workflows into GitHub repositories, expanding the attack surface. Persistence mechanisms and evasion techniques reduce the likelihood of detection and removal. Overall, this leads to severe confidentiality, integrity, and availability risks.
Mitigation Recommendations
No official patch or fix is currently documented for this malicious package compromise. Immediate mitigation requires removing the affected package versions (=7.4.1, =7.4.2, =7.4.4) from all systems. However, removal alone does not guarantee eradication due to persistence mechanisms. All secrets and credentials potentially exposed should be rotated immediately from a secure, uncompromised environment. Monitor for suspicious activity related to npm publishing, GitHub workflows, and privilege escalations. Review and harden Docker socket access controls to prevent container escape. Follow vendor advisories and security community updates for any forthcoming official remediation or guidance.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-5138
- Osv Schema Version
- 1.7.4
- Aliases
- ["GHSA-r9mp-ff22-jhrr"]
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a520ee368715ace4391ad97
Added to database: 07/11/2026, 09:37:39 UTC
Last enriched: 07/11/2026, 10:07:39 UTC
Last updated: 07/23/2026, 06:57:11 UTC
Views: 10
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.