Mini Shai-Hulud Hits Red Hat NPM Packages

Threat Intel
, , ,
1

Last Updated: 2026-06-02T17:32:42Z

What’s Happening

Yet another “Shai-Hulud” style NPM attack, this time against Red Hat cloud services packages. Socket has the full report.

Affected packages have been unpublished, but it’s unclear if new packages have yet been issued, or the root cause of the compromise identified.

Red Hat has a security bulletin, but with limited information at this time.

Actions

Review the listed packages and versions for compromise. Full package list here:

https://socket.dev/supply-chain-attacks/red-hat-cloud-services-package-compromise

Consider anything in your environment with these packages compromised, as well as any tokens/secrets present on that system.

Review the indicators of compromise, in particular the execution of bun from non-standard locations. This continues to be a high-fidelity indicator of this attack type, and should be highly monitored/alerted, if not outright blocked.

Notes

This appears to be using the playbook demonstrated in the open source “Mini Shai-Hulud” repository released by TeamPCP last month.

The network indicators of compromise are entirely “trusted sites.” It is interesting that primary exfiltration is to Claude via api.anthropic[.]com. It will be interesting to see how they’re using Claude in this way. That said, the URL from Socket is incomplete, and Step Security’s writeup omits that C2 as of now.

2

I am… deeply confused about the supposed C2 to anthropic. I’m not sure if the code snippet is incomplete but this very much feels like something that should just 404, given the lack of an actual endpoint, so unlikely to be actual C2/Exfil?

Checking the Stepsecurity writeup ( Multiple redhat-cloud-services npm Packages compromised - StepSecurity ) they make mention of HTTPS to some domain as the primary exfil method but do not list it (yet).

Unfortunately can’t find a source just checking this with dynamic analysis & don’t have the setup to check myself :pensive_face:

1 Like
3

Both could be true. Step hasn’t posted the decrypted C2, and you’re right that the URL is incomplete in Socket’s writeup. If it is Anthropic, I’m betting on something like the Memory Tool to store data. But for that you’d need the POST data to be sure.

4

Red Hat Security Bulletin: RHSB-2026-006 Supply chain compromise of @redhat-cloud-services npm packages | Red Hat Customer Portal

2 Likes