Miasma: Red Hat npm Packages Hit by a Self-Propagating Worm
On June 1, 2026, researchers identified malicious code embedded across 32 packages published under the @redhat-cloud-services npm namespace, a set of frontend components and API clients that power the Red Hat Hybrid Cloud Console. The campaign, named Miasma, published 96 malicious versions in two waves roughly three hours apart and carried a preinstall script that harvested developer and cloud credentials while attempting to self-propagate to other packages the victim had publish rights to. Researchers described the payload as a lightly reskinned descendant of the Shai-Hulud worm family that first surfaced in September 2025.
What happened
The intrusion did not begin with a stolen npm token in isolation; it began with a compromised Red Hat employee GitHub account, which was used to push orphan commits directly into several RedHatInsights repositories, bypassing the branch protections and code review that would normally catch an unexpected change. From there, the attacker published two waves of malicious versions, at approximately 10:53 UTC and again between 13:44 and 13:46 UTC on June 1, 2026.
Once installed, the preinstall script ran an obfuscated payload immediately, before any application code executed, harvesting developer and cloud credentials and attempting to spread itself further by publishing to any other packages the compromised account or machine had rights to, the same self-propagating mechanism that made Shai-Hulud and its later variants spread faster than a single-target compromise. The affected packages average roughly 80,000 combined weekly downloads, meaning the blast radius extended well beyond Red Hat's own internal pipelines to any organization pulling in Hybrid Cloud Console components.
How 0Day mitigates this
See the original Shai-Hulud worm this payload descended from, or read how continuous monitoring differs from a periodic scan.
Sources
Wiz: Miasma, Supply Chain Attack Targeting Red Hat npm Packages
Microsoft Security Blog: Preinstall to Persistence, Inside the Red Hat npm Miasma Campaign
Snyk: Miasma Attack Hits Red Hat npm Packages