Compromised Red Hat accounts are spreading credential-stealing worm

Abuses assumed trust in short-lived GitHub tokens

A threat actor has compromised official Red Hat accounts on Node Package Manager (NPM), using them to push self-propagating malware.

Researchers at Aikido spotted the attack on Monday, when the compromised accounts began distributing official packages containing a credential-stealing worm that appears similar to the Mini Shai-Hulud malware.

Mini Shai-Hulud's developer TeamPCP released the malware as open-source, allowing other criminal groups to replicate or adapt the techniques it uses.

In total, Aikido says 96 versions across 32 packages have been compromised, cumulatively downloaded 116,991 times per week. They were published via GitHub Actions OIDC, suggesting a compromise of the CI/CD pipeline rather than an NPM token.

When trust fails

Aikido tracked the attack to a Red Hat employee’s compromised GitHub account, which was used to push malicious orphan commits directly to several repositories, bypassing code review.

The orphan commits contain both a workflow file and a script. The script requests a short-lived OIDC token from GitHub, then uses it to authenticate directly with NPM's trusted publishing endpoint and publish backdoored versions of every package in the list.

OIDC-based trusted publishing, which was designed to eliminate long-lived tokens, thus becomes “a misleading trust signal.”

What is targeted?

Like previous Mini Shai-Hulud attacks, the malware in this case seeks credentials. It performs a broad sweep across cloud providers, CI/CD environments and developer tooling.

On CI, it targets specific GitHub Actions secrets like GITHUB_TOKEN and ACTIONS_RUNTIME_TOKEN. In cloud, it collects AWS access keys and session tokens, GCP application default credentials and service account key files, and Azure service principal credentials and managed identity tokens.

The payload also sweeps for credentials from HashiCorp, Kubernetes, Docker and other environments.

As of writing the attack is still active. If you have installed any affected package versions since 1^st June (yesterday), the advice is to “treat all CI secrets, cloud credentials, SSH keys and npm tokens as compromised and rotate them immediately.”