Red Hat Cloud Services npm Trusted-Publishing Compromise

Suspected

Discovered Jun 2, 2026

Multiple @redhat-cloud-services npm packages were compromised on 2026-06-01 through trusted-publishing abuse tied to the Mini Shai-Hulud Miasma wave. The malicious releases added install-time payload execution, credential collection, destructive fallback behavior, and GitHub workflow tampering risk.

Affected Packages

Observables

Sources

Defender Action Panel

Triage this incident quickly

Check whether your environment installed affected software, copy the top IOCs, run the tested hunting script when available, then review remediation guidance.

Current dossier state: needs review
Last verified: Not yet independently verified
Am I affected?: Review affected software below
Immediate action: Audit locks, CI runners, developer workstations, and credential exposure.
Hunting: Has hunting script

Observed fact

Direct-source and cited evidence only.

Informed inference

Analysis is labelled where evidence is indirect.

Unknown

Unverified scope remains explicitly open.

Copy IOCs Run hunting script View sources Jump to remediation

package[.]json
package-lock[.]json
pnpm-lock[.]yaml
yarn[.]lock
bun[.]lock

Analysis

Executive Summary

On 2026-06-01, researchers reported a new Mini Shai-Hulud child event affecting the @redhat-cloud-services npm scope. StepSecurity identified 31 malicious package versions across 29 packages, published through trusted publishing after an attacker compromised the RedHatInsights/javascript-clients GitHub workflow path and abused OIDC-based npm publishing [stepsecurity.io opens in a new tab].

This is not a normal vulnerable dependency advisory. It is a supply-chain publish compromise against Red Hat Cloud Services client packages that can execute during npm install. The reported payload is called Miasma, also tracked as The Spreading Blight, and it overlaps the same Mini Shai-Hulud operational pattern of CI/CD compromise, credential theft, GitHub workflow tampering, and destructive pressure after token invalidation [stepsecurity.io opens in a new tab] [ox.security opens in a new tab].

Organizations should search for affected @redhat-cloud-services/* packages in source repositories, lockfiles, package caches, build logs, CI artifacts, and container layers. Any confirmed install on a developer workstation or runner with GitHub, npm, cloud, or deployment credentials should trigger credential rotation from a clean environment.

Source-Watcher Candidate Queue — research metadata

Candidate Id: redhat-cloud-services-npm-miasma-compromise

First Seen: 2026-06-01

Decision: publish_ready

Relationship: child_event_of_mini_shai_hulud_worm

Dedupe Keys:

npm:@redhat-cloud-services
repo:RedHatInsights/javascript-clients
package:@redhat-cloud-services/patch-client@4.0.4
payload:miasma
campaign:mini-shai-hulud

Starting Sources:

StepSecurity primary research
OX Security primary research
Mend primary research
BleepingComputer Red Hat statement

Key Facts

Threat Type: malicious npm package publish compromise

Ecosystem: npm

Registry: npm

Campaign Context: Mini Shai-Hulud / Miasma / The Spreading Blight

Affected Scope: @redhat-cloud-services

Source Repository: RedHatInsights/javascript-clients

Reported Publish Date: 2026-06-01

Reported Package Count: 29

Reported Malicious Version Count: 31

Execution Trigger: npm install lifecycle script

Publish Path: GitHub Actions trusted publishing / npm OIDC

Credential Risk:

GitHub tokens
npm publishing tokens
cloud credentials
CI/CD deployment credentials
developer workstation secrets

Evidence Assessment

Analysis table
Claim	Status	Evidence
Multiple `@redhat-cloud-services` npm packages were maliciously published on 2026-06-01.	confirmed	StepSecurity reports 31 malicious versions across 29 packages and lists exact package/version pairs [stepsecurity.io opens in a new tab].
The compromise path involved the `RedHatInsights/javascript-clients` GitHub repository and OIDC trusted publishing.	confirmed	StepSecurity describes the attacker-created pull request, merged branch, workflow execution, and trusted-publishing abuse path [stepsecurity.io opens in a new tab].
The payload is tracked as Miasma or The Spreading Blight and overlaps Mini Shai-Hulud behavior.	likely	StepSecurity and OX both connect the behavior to the Mini Shai-Hulud family and describe destructive or worm-like behavior [stepsecurity.io opens in a new tab] [ox.security opens in a new tab].
The malicious code targets credentials and can tamper with GitHub repository state.	confirmed	StepSecurity and Mend describe credential theft, GitHub workflow manipulation, and repository-level changes [stepsecurity.io opens in a new tab] [mend.io opens in a new tab].
Red Hat says it removed the compromised package versions and rotated exposed tokens.	confirmed	BleepingComputer published a Red Hat statement saying affected versions were removed and exposed tokens were rotated [bleepingcomputer.com opens in a new tab].
Public sources currently prove downstream victim count or successful cloud abuse.	not_observed	None of the reviewed public sources provides a verified victim count or confirmed downstream cloud-control-plane abuse list.

Impact Determination

Analysis table
Classification	Criteria	Required evidence	Handling decision	Closure condition
Confirmed compromise	An affected package/version was installed or executed and endpoint, process, network, or GitHub audit telemetry shows Miasma selectors or credential collection behavior.	Lockfile/cache hit plus package install logs, process telemetry, shell history, endpoint telemetry, proxy logs, or GitHub audit activity.	Isolate the host or runner, preserve package artifacts, rotate reachable credentials, and audit follow-on GitHub/npm/cloud activity.	Affected packages are removed, credentials are rotated, and downstream audits show no unexplained write activity.
Presumed exposed	An affected package/version was installed on a developer workstation, CI runner, image build, or release environment but runtime telemetry is incomplete.	Dependency lock, package cache, build log, container layer, or npm install record.	Treat GitHub, npm, cloud, registry, and deployment credentials reachable from that environment as exposed.	Risk owners confirm clean rebuilds and credential rotation or accept residual risk.
Potentially exposed	Repositories or builds use `@redhat-cloud-services/*`, but exact resolved versions or install execution is not established.	Repository manifests, lockfiles, private registry logs, CI logs, and package-cache inventory.	Reconstruct package resolution and install execution before narrowing scope.	Each hit is dispositioned as confirmed compromise, presumed exposed, or not exposed.
Not exposed	No affected package names, affected versions, package-cache artifacts, tarballs, or runtime selectors appear in complete evidence.	Negative search across repos, CI logs, package caches, endpoint telemetry, proxy logs, and registry mirrors.	Preserve negative evidence and keep lifecycle-script controls in place.	Evidence coverage includes developer endpoints, CI runners, production builds, and internal mirrors.
Unknown	Dependency inventory, package-cache data, runner telemetry, endpoint telemetry, or audit logs are unavailable.	Named gap with system owner and retention window.	Keep credentials in scope until evidence is recovered or rotation closes the gap.	Missing evidence is recovered or the risk owner accepts residual uncertainty.

Timeline

2026-06-01: StepSecurity reports malicious @redhat-cloud-services package versions and ties the activity to a trusted-publishing workflow compromise [stepsecurity.io opens in a new tab].
2026-06-01: OX publishes its analysis of the Red Hat Cloud Services npm compromise and frames the activity as a Mini Shai-Hulud return wave [ox.security opens in a new tab].
2026-06-01: Mend publishes a companion analysis of the Miasma payload and highlights malicious behavior in the npm package set [mend.io opens in a new tab].
2026-06-02: This Halting Problems refresh found no existing local post for the @redhat-cloud-services Miasma wave and created this child event report.

Technical Analysis

The material supply-chain failure is not the mere existence of vulnerable package code. It is the use of trusted CI/CD publishing to push malicious package versions into the public npm registry. StepSecurity reports that the attacker opened a pull request in RedHatInsights/javascript-clients, got workflow-controlled publishing execution, and used the resulting OIDC trusted-publishing path to publish malicious versions [stepsecurity.io opens in a new tab].

The payload belongs in the same response family as Mini Shai-Hulud because the defensive questions are the same: which package versions resolved, which install hooks executed, which credentials were reachable, and what GitHub/npm/cloud activity followed. OX and Mend both describe the payload as a new wave using Miasma or The Spreading Blight naming, with destructive and credential-theft behavior [ox.security opens in a new tab] [mend.io opens in a new tab].

Treat successful installation on a runner as credential exposure unless telemetry proves the lifecycle script did not run. Lockfile-only evidence is not enough for confirmed compromise, but it is enough to keep the environment in scope until package-cache and install-log evidence is collected. [1]

Indicators of Compromise

The following indicators of compromise (IOCs) can be used to scope exposure across local repositories, systems, and telemetry exports:

Domains

registry[.]npmjs[.]org
api[.]github[.]com
github[.]com

Urls

hxxps://github[.]com/RedHatInsights/javascript-clients

Downstream Abuse Audits

Compromised workstations expose active API credentials, requiring immediate rotated revocation. The following platforms are at risk:

GitHub OIDC and PATs: Attackers harvested SSH private keys and Git Personal Access Tokens. Auditors must inspect recent action runs and release logs during the exposure window.
Cloud IAM Credentials: AWS, Azure, and GCP session tokens. CloudTrail and Activity Logs should be queried for AssumeRole or write operations originating from unexpected IP addresses.
NPM and Package Registries: Publishing tokens and credentials. Registry profiles must be audited for unauthorized version publishes or token additions.

Remediation and Closure

Remove affected packages from lockfiles, purge package-manager caches, rebuild containers from clean dependency state, and block affected package/version pairs in private registry policy. For environments that installed the malicious versions, rotate credentials from a clean host before reconnecting the original asset.

Closure requires negative evidence across repositories, package caches, build logs, CI runner artifacts, endpoint telemetry, and internal npm mirrors. If telemetry is unavailable, close the gap with broad credential rotation and a documented residual-risk decision.

Sources

Timeline

Timeline
Date	Event	Description	Source

Jun 2, 2026	First seen	First seen recorded for Red Hat Cloud Services npm Trusted-Publishing Compromise.	bleepingcomputer.com
Jun 2, 2026	Discovery	Discovery recorded for Red Hat Cloud Services npm Trusted-Publishing Compromise.	bleepingcomputer.com
Jun 2, 2026	Disclosure	Disclosure recorded for Red Hat Cloud Services npm Trusted-Publishing Compromise.	bleepingcomputer.com
Jun 2, 2026	Red Hat Cloud Services npm Trusted-Publishing Compromise	Unknown	bleepingcomputer.com

Affected Software

Affected Software
Package	Ecosystem	Version Range	Status	Confidence	Source
No rows match the active filters.

IOC Clipboard

16 IOCs

file_pathpackage.json

file_pathpackage-lock.json

file_pathpnpm-lock.yaml

file_pathyarn.lock

file_pathbun.lock

file_pathindex.js

file_path.github/workflows/codeql.yml

commandnpm install executing lifecycle script from @redhat-cloud-services package

commandnode or bun process launched from package lifecycle hook

commandworkflow run using id-token: write and npm trusted publishing

network_patternGitHub API activity from developer or CI host after package install

network_patternnpm publish or dist-tag activity tied to trusted-publishing workflow

domainregistry.npmjs.org

domainapi.github.com

domaingithub.com

urlhttps://github.com/RedHatInsights/javascript-clients

Tested Hunting Scripts

Tested Hunting Scripts
Title	Language	Description	Repository	Source
local repository and exported telemetry scope	Python	Does the telemetry scope contain patterns associated with Red Hat Cloud Services npm Trusted-Publishing Compromise?	scripts/local_repository_and_exported_telemetry_scope.py opens in a new tab	bleepingcomputer.com

Hunt Manifest: local repository and exported telemetry scope

Title: local repository and exported telemetry scope
Question: Does the telemetry scope contain patterns associated with Red Hat Cloud Services npm Trusted-Publishing Compromise?
Telemetry Family: Python
Repository: scripts/local_repository_and_exported_telemetry_scope.py

Show tested hunting scriptscripts/local_repository_and_exported_telemetry_scope.py

#!/usr/bin/env python3
"""Generated offline hunt scanner; regenerate with generate_scanners.py."""
import importlib.util
import os
from pathlib import Path
import sys

PACKAGES = [
    "@redhat-cloud-services/patch-client@4.0.4",
    "@redhat-cloud-services/insights-client@3.0.3",
    "@redhat-cloud-services/host-inventory-client@2.0.4",
    "@redhat-cloud-services/vulnerabilities-client@2.0.3",
    "@redhat-cloud-services/vulnerabilities-client@2.0.4",
    "@redhat-cloud-services/remediations-client@4.0.3",
    "@redhat-cloud-services/sources-client@3.0.4",
    "@redhat-cloud-services/compliance-client@3.0.4",
    "@redhat-cloud-services/rbac-client@2.0.3",
    "@redhat-cloud-services/advisor-client@4.0.3",
    "@redhat-cloud-services/notifications-client@3.0.3",
    "@redhat-cloud-services/integrations-client@2.0.4",
    "@redhat-cloud-services/drift-client@3.0.3",
    "@redhat-cloud-services/content-sources-client@4.0.4",
    "@redhat-cloud-services/approval-client@2.0.3",
    "@redhat-cloud-services/topms-client@2.0.4",
    "@redhat-cloud-services/ros-client@2.0.4",
    "@redhat-cloud-services/cost-management-client@3.0.4",
    "@redhat-cloud-services/subscriptions-client@3.0.4",
    "@redhat-cloud-services/swatch-client@2.0.3",
    "@redhat-cloud-services/image-builder-client@3.0.3",
    "@redhat-cloud-services/vulnerability-client@2.0.4",
    "@redhat-cloud-services/provisioning-client@2.0.3",
    "@redhat-cloud-services/patch-advisory-client@2.0.3",
    "@redhat-cloud-services/quickstarts-client@2.0.3",
    "@redhat-cloud-services/notifications-backend-client@2.0.4",
    "@redhat-cloud-services/landing-page-frontend@2.0.3",
    "@redhat-cloud-services/frontend-components@6.0.4",
    "@redhat-cloud-services/frontend-components-utilities@4.0.4",
    "@redhat-cloud-services/frontend-components-notifications@3.0.4"
]
FILES = [
    "package.json",
    "package-lock.json",
    "pnpm-lock.yaml",
    "yarn.lock",
    "bun.lock",
    "index.js",
    ".github/workflows/codeql.yml"
]
PROCESS_PATTERNS = [
    "npm install executing lifecycle script from @redhat-cloud-services package",
    "node or bun process launched from package lifecycle hook",
    "workflow run using id-token: write and npm trusted publishing"
]
NETWORK_PATTERNS = [
    "GitHub API activity from developer or CI host after package install",
    "npm publish or dist-tag activity tied to trusted-publishing workflow"
]
PROFILE = {
    'packages': PACKAGES,
    'files': FILES,
    'process_patterns': PROCESS_PATTERNS,
    'network_patterns': NETWORK_PATTERNS
}

def main() -> int:
    try:
        runtime_path = Path(__file__).resolve().parents[2] / "scanner_runtime.py"
        spec = importlib.util.spec_from_file_location("hp_scanner_runtime", runtime_path)
        if spec is None or spec.loader is None:
            print(f"scanner runtime not found: {runtime_path}", file=sys.stderr)
            return 2
        runtime = importlib.util.module_from_spec(spec)
        spec.loader.exec_module(runtime)
        args = list(sys.argv[1:])
        if os.environ.get("LOG_ROOT") and "--log-root" not in args:
            args.extend(["--log-root", os.environ["LOG_ROOT"]])
        if os.environ.get("OUT") and "--out" not in args:
            args.extend(["--out", os.environ["OUT"]])
        return runtime.main(args, PROFILE) if args else 2
    except Exception as exc:
        print(f"scanner execution error: {exc}", file=sys.stderr)
        return 2

if __name__ == "__main__":
    raise SystemExit(main())

Provenance & Sources

Provenance & Sources
Source	Type	Reliability	Claims	Evidence

bleepingcomputer.com	Security Researcher	95%	1	Multiple @redhat-cloud-services npm packages were compromised on 2026-06-01 through trusted-publishing abuse tied to the Mini Shai-Hulud Miasma wave. The malicious releases added install-time payload execution, credential collection, destructive fallback behavior, and GitHub workflow tampering risk.
StepSecurity	Security Researcher	95%	1	Multiple @redhat-cloud-services npm packages were compromised on 2026-06-01 through trusted-publishing abuse tied to the Mini Shai-Hulud Miasma wave. The malicious releases added install-time payload execution, credential collection, destructive fallback behavior, and GitHub workflow tampering risk.
mend.io	Security Researcher	95%	1	Multiple @redhat-cloud-services npm packages were compromised on 2026-06-01 through trusted-publishing abuse tied to the Mini Shai-Hulud Miasma wave. The malicious releases added install-time payload execution, credential collection, destructive fallback behavior, and GitHub workflow tampering risk.
ox.security	Security Researcher	95%	1	Multiple @redhat-cloud-services npm packages were compromised on 2026-06-01 through trusted-publishing abuse tied to the Mini Shai-Hulud Miasma wave. The malicious releases added install-time payload execution, credential collection, destructive fallback behavior, and GitHub workflow tampering risk.