Red Hat Cloud Services npm Packages Hijacked to Deploy Credential-Stealing Worm
On June 1, 2026, 96 versions of 32 @redhat-cloud-services npm packages were compromised via a trusted-publishing bypass, embedding the Mini Shai-Hulud-derived “Miasma” worm that steals CI/CD credentials. The attack, linked to the open-source TeamPCP toolkit, has prompted urgent rotation of cloud, SSH and npm secrets for affected users.