Red Hat npm namespace poisoned via a maintainer's editor

Red Hat confirmed in early June 2026 that attackers had published malicious versions of 32 npm packages in its @redhat-cloud-services namespace, using an employee's GitHub account that had been compromised through a booby-trapped Visual Studio Code extension.

The affected packages are frontend JavaScript libraries that build the Hybrid Cloud Console at console.redhat.com, Red Hat's web interface for managing subscriptions and cloud services. They are not headline packages, but between them they accounted for roughly 117,000 weekly npm downloads, most of it into build pipelines rather than onto developer laptops.

In security bulletin RHSB-2026-006, published June 2, Red Hat said the intrusion began on May 29, when the attacker used the stolen GitHub account to inject malicious code into repositories in a Red Hat GitHub organization and to alter configuration files in a way designed to infect other developers who worked on them. Ninety-six versions across the 32 packages reached the npm registry. The malware, which researchers had begun tracking as Miasma, arrived as a preinstall script, which meant it executed during npm install before any application code ran.

Red Hat engineering removed the compromised versions from npm after disclosure and said no Red Hat product or enterprise software had been built or shipped with an affected version, so customers were not asked to take action. The entry point drew as much comment as the payload. A developer's editor extension is not usually modeled as part of a vendor's release pipeline, and in this case it was the shortest path to a namespace trusted by everyone who builds against the console.