# Chainguard customers safe from Mini Shai-Hulud worm targeting @redhat-cloud-services npm packages with 100K+ weekly downloads

DevFeed: [Chainguard customers safe from Mini Shai-Hulud worm targeting @redhat-cloud-services npm packages with 100K+ weekly downloads](<https://devfeed.tech/articles/chainguard-customers-safe-from-mini-shai-hulud-worm-targeting-redhat-cloud-services-npm-packages-with-100k-weekly-downloads-12938.md>)

Original publisher: [Read original article](<https://www.chainguard.dev/unchained/chainguard-customers-safe-from-mini-shai-hulud-worm-targeting-redhat-cloud-services-npm-packages>)

Published: 2026-06-01T00:00:00Z

Content type: news

Language: en

Sources: [Chainguard: Unchained](<https://devfeed.tech/sources/chainguard-unchained.md>)

Topics: [npm](<https://devfeed.tech/topics/npm.md>), [Security](<https://devfeed.tech/topics/security.md>), [GitHub Actions](<https://devfeed.tech/topics/github-actions.md>), [npm packages](<https://devfeed.tech/topics/npm-packages.md>), [GitHub](<https://devfeed.tech/topics/github.md>), [obfuscation](<https://devfeed.tech/topics/obfuscation.md>), [payload](<https://devfeed.tech/topics/payload.md>), [OpenID connect (OIDC)](<https://devfeed.tech/topics/oidc.md>)

Tags: [chainguard-actions](<https://devfeed.tech/tags/chainguard-actions.md>), [chainguard-libraries](<https://devfeed.tech/tags/chainguard-libraries.md>), [endpoint-security](<https://devfeed.tech/tags/endpoint-security.md>), [github](<https://devfeed.tech/tags/github.md>), [github-actions](<https://devfeed.tech/tags/github-actions.md>), [malware](<https://devfeed.tech/tags/malware.md>), [mini-shai-hulud](<https://devfeed.tech/tags/mini-shai-hulud.md>), [npm](<https://devfeed.tech/tags/npm.md>), [obfuscation](<https://devfeed.tech/tags/obfuscation.md>), [oidc](<https://devfeed.tech/tags/oidc.md>), [packages](<https://devfeed.tech/tags/packages.md>), [payload](<https://devfeed.tech/tags/payload.md>), [red-hat](<https://devfeed.tech/tags/red-hat.md>), [redhat-cloud-services](<https://devfeed.tech/tags/redhat-cloud-services.md>), [security](<https://devfeed.tech/tags/security.md>), [shai-hulud](<https://devfeed.tech/tags/shai-hulud.md>), [tokens](<https://devfeed.tech/tags/tokens.md>)

## AI overview

The article reports that the Mini Shai-Hulud worm compromised more than 90 @redhat-cloud-services npm packages through a hijacked GitHub account and GitHub Actions OIDC trusted publishing. The worm spreads tampered packages and malicious workflows, executes an obfuscated payload during installation, and steals cloud, Vault, GitHub, npm, and CI credentials. Chainguard customers using Chainguard Libraries for JavaScript and Chainguard Actions were unaffected.

## Source excerpt

A new npm worm hit 90+ Red Hat packages. Chainguard customers stayed protected by blocking install-time scripts and hardening CI/CD workflows.