Threats Tagged 'mal-2026-5137'

The @redhat-cloud-services/frontend-components-translations npm package versions 4.4.1, 4.4.2, and 4.4.4 were compromised as part of the "Mini Shai-Hulud" supply chain worm campaign. The attacker injected a malicious preinstall hook that delivers a multi-layer obfuscated payload to download and execute a Bun runtime, enabling extensive credential theft, privilege escalation, self-propagation, persistence, and evasion techniques. The malware harvests a wide range of cloud, CI/CD, and local credentials, escapes container environments, repurposes stolen npm credentials to republish malicious packages, and implants persistence mechanisms. Systems with this package installed should be considered fully compromised, and all secrets should be rotated immediately.