Red Hat npm Packages Compromised to Spread a Credential-Stealing Worm

What it is

The Aikido advisory on the June 1, 2026 compromise of 32 @redhat-cloud-services npm packages (96 versions, ~116,991 weekly downloads) with "Miasma," a Mini Shai-Hulud variant. What the summary does not carry: the concrete indicators to hunt for, the rotation trigger date, and the specific detail that this was a trusted-publishing bypass, not a stolen npm token.

How it works

A compromised Red Hat employee GitHub account pushed orphan commits directly to repos (e.g. RedHatInsights/frontend-components), bypassing code review. Those commits added a workflow ci.yaml and a script _index.js. The workflow requests id-token: write permission, runs bun run _index.js, and passes a target package list via an OIDC_PACKAGES env var. _index.js uses the short-lived GitHub OIDC token to authenticate to npm's trusted-publishing endpoint and publish backdoored versions. Each published package carries a preinstall hook that runs a 4.2 MB obfuscated index.js on every install, before any application code.

The key inversion the page states: OIDC trusted publishing was meant to eliminate long-lived tokens, but a compromised CI pipeline turns it into a "misleading trust signal" — the publish looks legitimate because it came through OIDC.

Preconditions / Affected

Anyone who installed an affected @redhat-cloud-services package version on or after June 1, 2026. The preinstall script runs credential theft during npm install regardless of whether the package is imported.

What to do

The page's explicit instruction: if you installed any affected version since June 1, 2026, treat all CI secrets, cloud credentials, SSH keys, and npm tokens as compromised and rotate them immediately.

Hunt for these indicators:

• Repo commits: unexplained orphan commits adding ci.yaml and _index.js
• A workflow granting id-token: write that runs bun run _index.js with an OIDC_PACKAGES env var
• package.json containing:

"scripts": {
  "preinstall": "node index.js"
}

• Pinned action SHAs used by the malicious workflow: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd and oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6

Credentials the payload targets — check exposure and rotation scope: GitHub Actions GITHUB_TOKEN and ACTIONS_RUNTIME_TOKEN; AWS access keys and session tokens; GCP application default credentials and service-account key files; Azure service principal and managed-identity tokens.

Caveats

The fetched text is truncated mid-sentence in the "What it steals" section ("It also sweeps for…"), so the full credential list is incomplete here. Attribution to TeamPCP is by malware resemblance; because the Mini Shai-Hulud source was open-sourced (May 12, 2026), the page notes other actors can now run identical campaigns, so these indicators are not unique to one group.