Red Hat Confirms Supply Chain Compromise of Cloud Services npm Packages

Key Takeaways

• Red Hat confirmed a supply chain compromise affecting multiple npm packages under the @redhat-cloud-services namespace.
• The incident, disclosed on June 1, 2026, involved a sophisticated six-stage infostealer called Shai-Hulud.
• A compromised GitHub account was used to inject malicious code into frontend libraries, leveraging GitHub as a dynamic command-and-control (C2) server.
• Red Hat swiftly removed compromised versions from npm and is actively investigating the impact on product builds.
• No immediate customer action is required, but organizations should monitor for specific Shai-Hulud indicators of compromise (IoCs).

Red Hat Supply Chain Compromise Impacts Cloud Services npm Packages

Red Hat has officially acknowledged a supply chain attack targeting several npm packages distributed under its @redhat-cloud-services namespace. The company publicly disclosed the security incident on June 1, 2026, revealing that malicious code was injected into critical frontend libraries.

The compromise originated from a GitHub account that was breached, allowing an attacker to insert harmful code into repositories maintained within a Red Hat GitHub organization. This incident raises significant alarm for enterprise environments, particularly those relying on these npm packages during their container image build processes.

Attack Vector and Shai-Hulud Infostealer

According to Red Hat’s security bulletin RHSB-2026-006, unauthorized commits were pushed to repositories within the RedHatInsights GitHub organization. This was achieved using a developer account that had been compromised.

The affected npm packages are frontend libraries, which are typically compiled and bundled into container images during Red Hat’s product build pipeline. This deep integration makes the attack vector particularly dangerous, as it could potentially embed malicious code into downstream products. Red Hat’s engineering teams responded rapidly by removing the compromised versions from the npm registry shortly after the initial discovery.

Threat intelligence firm OX Security has identified the malware behind this sophisticated supply chain compromise as the “Shai-Hulud” infostealer. OX Security researchers characterize Shai-Hulud as significantly more advanced than typical npm malware, which usually operates with one to three execution stages. In contrast, Shai-Hulud employs a complex six-stage payload delivery chain designed to loop continuously.

The attack sequence begins with an obfuscated index.js payload. This initial payload then proceeds through multiple decryption and decoding stages, ultimately deploying 15 distinct malicious modules. These include memory dump tools, token monitors, hooks for the Claude API, and a GitHub-based payload dropper.

GitHub Utilized as Dynamic Command-and-Control

A particularly concerning aspect of the Shai-Hulud infostealer is its innovative use of GitHub as a dynamic Command-and-Control (C2) infrastructure. Instead of merely using GitHub to host exfiltrated data, the threat actor stores malicious code directly in GitHub repositories. They then leverage specific commits, tagged with the string “firedalazer,” as a mechanism for dynamic payload delivery.

This method provides the attackers with high resilience. Should one compromised account be detected and blocked, another can seamlessly take over by pushing new commits containing the “firedalazer” tag, ensuring the campaign’s continued operation.

OX Security’s analysis also revealed two distinct variants of the Shai-Hulud malware. These variants are differentiated by a subtle textual difference: the string “Miasma: The Spreading Blight” (without a space after the colon) in Stage 3, versus “Miasma : The Spreading Blight” (with a space) in an alternate Stage 6 payload. This minor distinction could allow detection tools relying on exact string matching to miss infections from one of the variants.

Red Hat Product Security is currently conducting comprehensive build system and dependency tracking analysis to ascertain whether any official product builds incorporated the compromised package versions. Based on current findings, Red Hat states that no immediate customer action is required, though the investigation remains active and ongoing.

What You Should Do

• Monitor your systems for known Shai-Hulud Indicators of Compromise (IoCs).
• Specifically, look for the “firedalazer” commit string in your GitHub activity and repositories.
• Search for “Miasma: The Spreading Blight” and “Miasma : The Spreading Blight” strings in logs and codebases.
• Refer to OX Security’s public disclosures for documented encryption keys and public key pairs associated with the malware.
• Ensure your software supply chain security practices are robust, including vigilant monitoring of third-party dependencies.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.