BreachPublished 1 Jun 2026

Red Hat npm packages compromised to steal developer credentials

Source Bleeping Computer

Description

More than 30 npm packages under Red Hat's '@redhat-cloud-services' namespace were compromised in a supply-chain attack that distributed a new variant of the Shai-Hulud credential-stealing malware, dubbed "Miasma." [...]

Impact

The malware steals sensitive developer credentials and secrets such as cloud provider credentials, SSH keys, CI/CD tokens, and other authentication tokens, potentially enabling attackers to access and compromise developer environments and cloud resources. However, Red Hat confirmed no impact on customer or partner environments or production systems. The compromised packages were limited to internal development tooling and have been removed from the npm registry. Organizations that installed affected package versions risk credential exposure and should assume compromise of secrets used on infected devices.

Defensive guidance

Red Hat has removed the affected packages from the npm registry and is investigating the incident. The compromise was limited to internal development tooling, and no impact to customer or production systems has been identified. Organizations that installed any affected package versions should immediately rotate all credentials, secrets, and tokens used on the infected devices. Users should monitor Red Hat's official advisories for updates and remediation guidance.

References

bleepingcomputer.com/news/security/red-hat-npm-packages-compromised-to-steal-developer-credentials/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 1 Jun 2026, 21:48 UTC

References

Community reviews