Red Hat has officially acknowledged a security incident involving its npm packages under the @redhat-cloud-services namespace, revealed publicly on June 1, 2026. This incident has sparked concerns within enterprise environments that rely on these packages during their container image build processes.
Compromised GitHub Account Identified
According to Red Hat’s security bulletin, unauthorized access was gained to a developer account, which was then used to inject malicious code into the frontend libraries hosted in a Red Hat GitHub organization. This breach has led to significant alarm due to the deep integration of these libraries in downstream build pipelines.
Red Hat’s engineering team responded by promptly removing the compromised package versions from npm following the disclosure. The affected packages, integral to Red Hat’s product build process, highlighted the potential risks posed by the attack.
Details of the Shai-Hulud Malware
OX Security has identified the malware involved in the breach as Shai-Hulud, a sophisticated infostealer campaign. Unlike typical npm malware that operates with a few stages, Shai-Hulud employs a complex six-stage payload delivery process that continuously loops back, making it notably advanced.
The attack initiates with an obfuscated payload in index.js, which undergoes decryption and decoding. This process ultimately results in the deployment of 15 distinct payloads, including tools for memory dumping, token monitoring, and more.
GitHub’s Role in the Attack
A particularly concerning aspect of Shai-Hulud is its use of GitHub as a live Command-and-Control (C2) infrastructure. The threat actor utilizes GitHub repositories to store and deliver malicious code, employing commits tagged with “firedalazer” as a dynamic delivery mechanism. This tactic enhances the campaign’s resilience, allowing it to persist even if one account is disabled.
OX Security also identified variations of the malware, distinguished by minor differences in strings, which could potentially evade detection tools that rely on exact string matching.
Red Hat Product Security is currently conducting an in-depth analysis of build systems and dependencies to determine if any product builds have integrated the compromised packages. Presently, no customer action is required, but organizations are advised to monitor known indicators of compromise related to Shai-Hulud.
