MalwarePublished 2 Jun 2026

Supply Chain Attack Hits 32 Red Hat NPM Packages

Source SecurityWeek

Description

Hackers published 96 malicious package versions, injected with a credential-stealing worm similar to Mini Shai-Hulud. The post Supply Chain Attack Hits 32 Red Hat NPM Packages appeared first on SecurityWeek .

Impact

The attack compromised the integrity of 32 widely used Red Hat NPM packages, potentially affecting millions of users and developers who downloaded these packages. The malware stole a broad range of sensitive credentials and tokens, risking further compromise of developer environments, cloud infrastructure, and source code repositories. At least 210 repositories have been identified with stolen credentials, indicating significant downstream impact. Users who installed the malicious packages may have had their build environments and systems compromised, requiring immediate remediation.

Defensive guidance

Red Hat maintainers have removed the malicious package versions from NPM and published clean releases. Users should update immediately to the clean versions of all affected packages. Anyone who installed a malicious version must assume their systems and build environments are compromised and should promptly rotate all credentials, tokens, API keys, and other sensitive information that may have been accessed by the malware. Developers should also audit transitive dependencies for affected packages and monitor their environments for unusual outbound network connections.

References

securityweek.com/supply-chain-attack-hits-32-red-hat-npm-packages/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 2 Jun 2026, 10:03 UTC

References

Community reviews