Reported by 1 outlet
Red Hat npm Compromise — Miasma/Shai-Hulud Variant Hits 32 Packages, 309 GitHub Repos Infected
hot0.0
Why this score
- Breadth
- 0.50 / 2.0 · 1 source
- Authority
- 1.80 / 2.0 · best outlet weight
- Severity
- 0.50 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.00 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Timeline
-
original reporting
Red Hat npm Compromise — Miasma/Shai-Hulud Variant Hits 32 Packages, 309 GitHub Repos Infected
bleepingcomputer.com · 134d ago · June 2nd, 2026
An attacker compromised a Red Hat employee's GitHub account and pushed malicious commits via GitHub Actions OIDC trusted publishing, backdooring 32 packages under
@redhat-cloud-services(96 versions, ~117K weekly downloads). The Miasma malware variant shares code with TeamPCP's Mini Shai-Hulud — stealing GitHub Actions secrets, AWS/GCP/Azure credentials, HashiCorp Vault tokens, Kubernetes SA tokens, npm/PyPI publishing tokens, SSH keys, and more. OX Security confirmed 309 compromised GitHub repositories. Red Hat stated no customer or production environments were impacted. All affected packages were removed from npm.