This threat involves malicious code injected into the @redhat-cloud-services/insights-client npm package (versions 4.0.4, 4.0.5, 4.0.7) as part of the "Mini Shai-Hulud" supply chain worm campaign. The attacker exploited the GitHub Actions OIDC trusted publisher shared by Red Hat Cloud Services npm packages to insert a preinstall hook delivering a multi-layer obfuscated payload. This payload downloads a pinned Bun runtime from GitHub to execute the worm outside the victim's Node.js environment. The malware harvests numerous credentials including AWS, Azure, GCP, HashiCorp Vault, Kubernetes tokens, GitHub PATs, npm tokens, and environment variables from about 40 CI platforms, as well as local password manager stores and configuration files. It exfiltrates stolen data to attacker-controlled public GitHub repositories. Privilege escalation is achieved by exploiting Docker socket access to escape containers and modify sudoers for passwordless sudo access. The worm self-propagates by republishing tampered npm packages using stolen credentials, injecting malicious CodeQL workflows into GitHub repositories, exchanging OIDC tokens for npm publish tokens, and signing artifacts via Sigstore to appear legitimate. Persistence is maintained through daemon installation and hijacking AI agent and editor task configurations. The malware detects sandbox environments and probes for EDR tools to evade detection. Due to the extensive compromise, systems with this package installed should be considered fully compromised, and all secrets must be rotated from a separate clean system.

Systems with the affected versions of @redhat-cloud-services/insights-client installed are fully compromised. The attacker gains access to a broad range of sensitive credentials across multiple cloud providers, CI platforms, and local password stores. Privilege escalation allows container escape and passwordless sudo access, increasing attacker control. The worm self-propagates by republishing malicious packages and injecting workflows into GitHub repositories, potentially spreading to other systems and repositories. Persistence mechanisms and evasion techniques reduce the likelihood of detection and removal. Removal of the package alone does not guarantee eradication of the malware or attacker presence. Credential and key compromise necessitates immediate rotation from a trusted environment.

No official patch or fix is indicated. Due to the severity and nature of the compromise, affected systems should be treated as fully compromised. The malicious package should be removed, but this alone is insufficient to ensure system integrity. All secrets, credentials, and keys stored on the compromised system must be rotated immediately from a separate, clean system. Investigate and remediate any persistence mechanisms or backdoors installed by the malware. Monitor for signs of lateral movement or further compromise. Follow incident response best practices for supply chain compromise scenarios.