Red Hat npm Supply Chain Attack Delivers Credential-Stealing Malware to Developers

What Happened

More than 30 npm packages under Red Hat's @redhat-cloud-services namespace were compromised in a confirmed supply-chain attack, per BleepingComputer. Attackers injected Miasma — a new variant of the Shai-Hulud credential-stealing malware — into the affected packages and distributed it through the public npm registry. Any developer, CI runner, or build pipeline that installed or updated one of these packages during the compromise window silently pulled down credential-harvesting code alongside legitimate tooling.

The @redhat-cloud-services namespace is heavily used in enterprise and cloud-native environments, particularly among teams building on OpenShift or Red Hat's hybrid cloud ecosystem.

Why It Matters

Supply-chain attacks through npm are among the most damaging vectors in the developer toolchain because the trust model works against you. If a compromised package is in your package.json, every developer machine, build server, and CI runner that executed npm install is a potential victim — and none of them did anything wrong.

Miasma targets developer credentials specifically: npm tokens, cloud provider keys (AWS, GCP, Azure), SSH private keys, .env file contents, browser-stored secrets, and shell history. A single hit on a CI runner can hand attackers lateral movement into your cloud environment, your source repositories, and potentially your downstream customers.

The Red Hat brand amplifies the risk. Developers are far less likely to scrutinize a version bump from a trusted enterprise vendor namespace, which is precisely why attackers chose it. This class of attack routinely goes undetected for weeks — the package installs cleanly, the build succeeds green, and the exfiltration runs silently.

What To Do

Audit immediately:

• Search all package.json files, lock files, and CI configs for any @redhat-cloud-services/* dependency. Include transitive dependencies: npm ls | grep @redhat-cloud-services.
• Cross-reference install and update timestamps for affected packages. Any environment that ran npm install with these packages in the window should be treated as potentially compromised.

Rotate credentials now on every system where an affected package executed:

• npm access tokens
• AWS, GCP, and Azure access keys
• SSH keys stored in ~/.ssh
• Any secrets reachable via environment variables or .env files

Review CI/CD logs for unexpected outbound DNS lookups or HTTP calls originating from build or install steps. Exfiltration traffic is the tell.

Scan for exposed secrets across your repos and CI environments using tools like truffleHog or gitleaks to surface anything Miasma may have already captured.

Pin or remove the dependency until Red Hat publishes clean, verified versions. Watch the official Red Hat Security Advisory channel for affected version ranges and remediation guidance.

If your organization uses Red Hat cloud tooling at scale, open an active incident now rather than waiting for evidence of breach. Credential theft at the build layer can take weeks to surface — by then the attacker has had ample time to pivot.