Red Hat npm Packages Compromised, Cloud Credentials Targeted by Mini Shai-Hulud Malware

A significant cloud security incident has emerged with the compromise of more than 30 Red Hat Cloud Services npm packages by a new iteration of the Mini Shai-Hulud malware. The attack, identified on June 1, 2026, involved malicious commits pushed to two RedHatInsights GitHub repositories after a Red Hat employee's GitHub account was compromised, allowing the attackers to bypass standard code review processes. The malware's operation is particularly stealthy and effective. It leverages a `preinstall` lifecycle hook, executing a substantial, obfuscated JavaScript payload during the `npm install` process, even before any application code runs. This payload is designed to aggressively search for and exfiltrate a broad spectrum of sensitive credentials from the developer's build environment. Among the targeted data are AWS, Google Cloud Platform (GCP), and Azure keys, tokens, and credentials. The malware also seeks GitHub Actions tokens, HashiCorp Vault tokens, Kubernetes credentials and configuration files, SSH private keys, and npm and PyPI publish tokens. Researchers from Orca and Wiz Security have identified this as a new variant of the Mini Shai-Hulud malware, previously used in other supply chain attacks. A critical feature of this new variant is its self-propagating capability. By harvesting npm authentication tokens, the malware attempts to publish new backdoored versions of packages that the compromised account has access to. Crucially, it utilizes npm's `bypass_2fa` publish parameter to circumvent two-factor authentication requirements, enabling each successfully infected machine to autonomously seed further waves of compromised packages without direct attacker involvement. This highlights a severe vulnerability in the software supply chain and the persistent risk posed by compromised developer identities.