orca.securityarticleOrca Security: Red Hat npm Packages Compromised in Supply-Chain Attack Spreading Credential-Stealing Worm
Orca describes the June 1, 2026 compromise of 32 npm packages under the @redhat-cloud-services scope, which came from a hijacked Red Hat employee GitHub account. The attacker injected malicious GitHub Actions workflows into three RedHatInsights repos and used OIDC tokens to publish backdoored versions with valid SLSA provenance. A preinstall hook runs a 4.2 MB obfuscated payload that sweeps CI, cloud, SSH, registry and .env credentials and self-propagates (the "Miasma" worm, attributed to TeamPCP or a copycat using Mini Shai-Hulud tooling). The post lists compromised versions and gives rotation and pinning guidance.
TL;DR 32 @redhat-cloud-services npm packages were backdoored via a hijacked GitHub account and OIDC publishing with valid provenance, spreading the Miasma credential-stealing worm.
Organisations named here
- @redhat-cloud-services
- RedHatInsights
Technologies named here
- Orca Security SCA scanning
- Chrome
- compliance-client
- GitHub Actions
- config-manager-client
- SLSA provenance attestations
- entitlements-client
- SBOM validation
- eslint-config-redhat-cloud-services
- frontend-components
- frontend-components-advisor-components
- frontend-components-config
- frontend-components-config-utilities
- frontend-components-notifications
- frontend-components-remediations
- frontend-components-testing
- frontend-components-translations
- frontend-components-utilities
- hcc-feo-mcp
- hcc-kessel-mcp
- hcc-pf-mcp
- host-inventory-client
- insights-client
- integrations-client
- javascript-clients-shared
- notifications-client
- patch-client
- quickstarts-client
- rbac-client
- remediations-client
- rule-components
- sources-client
- topological-inventory-client
- tsc-transform-imports
- types
- vulnerabilities-client
- RedHatInsights GitHub repositories with injected workflows
- Orca SCA
- @redhat-cloud-services/chrome
- @redhat-cloud-services/compliance-client
- Orca supply chain security capabilities
- GitHub Actions OIDC tokens
- @redhat-cloud-services/config-manager-client
- @redhat-cloud-services/entitlements-client
- @redhat-cloud-services/eslint-config-redhat-cloud-services
- @redhat-cloud-services/frontend-components
- @redhat-cloud-services/frontend-components-config
- @redhat-cloud-services/frontend-components-config-utilities
- @redhat-cloud-services/frontend-components-notifications
- @redhat-cloud-services/frontend-components-remediations
- @redhat-cloud-services/frontend-components-testing
- @redhat-cloud-services/frontend-components-translations
- @redhat-cloud-services/frontend-components-utilities
- @redhat-cloud-services/hcc-feo-mcp
- @redhat-cloud-services/hcc-kessel-mcp
- @redhat-cloud-services/hcc-pf-mcp
- @redhat-cloud-services/host-inventory-client
- @redhat-cloud-services/insights-client
- @redhat-cloud-services/integrations-client
- @redhat-cloud-services/javascript-clients-shared
- @redhat-cloud-services/notifications-client
- @redhat-cloud-services/patch-client
- @redhat-cloud-services/quickstarts-client
- @redhat-cloud-services/rbac-client
- @redhat-cloud-services/remediations-client
- @redhat-cloud-services/rule-components
- @redhat-cloud-services/sources-client
- @redhat-cloud-services/topological-inventory-client
- @redhat-cloud-services/tsc-transform-imports
- @redhat-cloud-services/types
- @redhat-cloud-services/vulnerabilities-client
- RedHatInsights/frontend-components
- RedHatInsights/javascript-clients
- RedHatInsights/platform-frontend-ai-toolkit
- npm
- GitHub
- OpenID Connect
- Orca Security
- Red Hat
- SLSA
Techniques named here
- Two attack waves
- Malicious npm preinstall lifecycle hook
- Credential theft/exfiltration via automated sweep
- Self-propagating supply chain worm
- Polymorphic payload generation to evade hash-based detection
- Abuse of CI/CD OIDC trust and provenance attestation
Threat actors named here
- TeamPCP
- Mini Shai-Hulud
- Miasma
Related in Supply Chain
