Compromised RedHat npm Package Install

Duo Tech@duotech

•updated Jun 2, 2026•2•0•7

Detects command line activity indicating the installation of packages from the compromised @redhat-cloud-services npm scope, which was leveraged in a supply chain attack to drop the Miasma/Shai-Hulud infostealer malware.