Threats Tagged 'mal-2026-5133'

The @redhat-cloud-services/compliance-client npm package versions 4.0.3, 4.0.4, and 4.0.6 were compromised as part of the "Mini Shai-Hulud" supply chain worm campaign. The attacker injected a complex obfuscated preinstall hook that downloads and executes a malicious Bun runtime. This malware harvests a wide range of cloud and local credentials, escalates privileges by exploiting Docker socket access, self-propagates by republishing tampered packages and injecting malicious GitHub workflows, and establishes persistence through daemon installation and editor hijacking. It also includes sandbox and EDR detection mechanisms. Any system with this package installed should be considered fully compromised, and all secrets must be rotated immediately from a separate system.