Mini Shai-Hulud Campaign Hits Red Hat Cloud Services npm Packages

Reported 01 Jun 2026 by otx · Severity: medium

A supply chain attack compromised multiple @redhat-cloud-services npm packages, executing malicious payloads automatically during installation via preinstall hooks. The attack uses AES-GCM encrypted payloads and obfuscated JavaScript loaders to harvest GitHub Actions secrets, npm