Security researchers have discovered malicious code in dozens of npm packages published under Red Hat’s name. According to researchers, the compromised packages were part of a supply chain attack in which malware was distributed via a compromised GitHub account belonging to an employee.
Researchers at security firm Wiz describe this as an active threat. They found malware in at least 32 package versions within the Red Hat Cloud Services environment. According to their analysis, the affected packages are collectively downloaded approximately 80,000 times per week. Security firm Socket even identified 95 affected versions.
The attackers reportedly gained access to a Red Hat employee’s GitHub account. Changes were then pushed directly to two Red Hat Insights repositories, bypassing standard review procedures. Through this route, the malicious code ultimately ended up in packages available via npm.
Malware active during installation
The infected packages contain a so-called preinstall hook. As a result, the malware is executed as soon as a developer installs a package using npm. The software itself does not even need to be used for this to happen.
Research by Socket shows that the malware is designed to collect sensitive data from development and cloud environments. This includes GitHub Actions secrets, npm tokens, cloud credentials, Kubernetes configurations, Vault data, and SSH keys. The code also contains mechanisms to exfiltrate stolen information in encrypted form and potentially cause new infections.
According to Wiz and Socket, the malware bears strong similarities to the Mini Shai-Hulud worm. This malware family specifically targets software developers and CI/CD environments and was previously linked to several large-scale supply chain attacks earlier this year.
A complicating factor is that the malware’s developers, known as TeamPCP, previously made the source code publicly available. As a result, it is impossible to determine whether the same group is behind the new attack or whether another actor has reused the code.
The name Shai-Hulud refers to the giant sandworms from the science fiction seriesDune. The malware has previously been linked to the infection of hundreds of npm packages and thousands of GitHub repositories.
Red Hat Investigates Incident
Red Hat has confirmed that it is aware of the incident. The company told The Register that the affected packages were immediately removed from the npm registry and that an investigation has been launched.
According to Red Hat, the affected packages were intended solely for internal development purposes and were not part of the software that customers receive via console.redhat.com. The company says it has not yet found any evidence that customer environments, partner systems, or its own production systems have been affected.
Security researchers advise organizations that have installed one of the compromised package versions to replace all affected credentials and tokens as a precaution. There is a possibility that this data was compromised during the installation of the packages.