{
  "video_id": "reddit_1u05t5e",
  "channel_slug": "ClaudeAI",
  "channel_handle": "r/ClaudeAI",
  "title": "An active attack is planting backdoors inside Claude Code right now. If you use npm, your credentials may already be compromised.",
  "url": "https://www.reddit.com/r/ClaudeAI/comments/1u05t5e/an_active_attack_is_planting_backdoors_inside/",
  "external_url": null,
  "upload_date": "20260608",
  "published_at": "2026-06-08T11:59:46+00:00",
  "transcript": "Last week a malware campaign hit 32 npm packages under \\`@redhat-cloud-services\\`. About 117,000 weekly downloads. If you installed an affected version, the malware planted itself inside your Claude Code startup settings and your VS Code project config. Every time you open either one, the attacker's code runs.  \n\n\nIt silently collects every credential on your machine and sends them to the attacker. Uninstalling the package does not remove it. The malware lives outside the package, in your editor config, and it survives cleanup.  \n\n\nIf you try to cut off the attacker's access by revoking tokens before removing the malware, it can wipe your entire home directory and overwrite the files so they cannot be recovered.  \n\n\nThree days later, a second wave hit 57 more packages using a new technique that bypasses the security tools that caught the first wave. 647,000 monthly downloads affected. Some malicious versions are still live on the npm registry. The worm is self-propagating, it uses stolen tokens to infect new packages automatically.  \n\n\nHere is how one stolen credential made all of this possible.  \n\n\nThe attacker got one Red Hat employee's GitHub login. Probably stolen weeks earlier by malware that grabs saved passwords from browsers. With that login they had the employee's access level.  \n\n\nThey pushed malicious code directly into three Red Hat repositories, no review needed, and triggered Red Hat's own build pipeline to publish the poisoned packages to npm. The packages came out with valid security certificates because Red Hat's own pipeline built them.   \n  \n  \nThere was no known vulnerability to scan for, and the malicious code was brand new, so security tools that look for known threats found nothing. The tools that caught it flagged it within hours, but by then the downloads had already happened.  \n\n\n32 packages. About 117,000 weekly downloads. 96 poisoned versions pushed in two waves on June 1.  \n\n\nOnce installed on a developer's machine, the malware collected every credential it could find. AWS, Google Cloud, Azure, Kubernetes, SSH keys, GitHub tokens, npm tokens. It checked for CrowdStrike and SentinelOne before acting to avoid detection.  \n\n\nThen it set up persistence. It planted code in two places: \\~/.claude/settings.json and .vscode/tasks.json. These run automatically when you open Claude Code or open a project. The attacker gets re-entry every time, even after you clean up the original package.  \n\n\nIt also registered the company's build servers as machines the attacker controls remotely. That is persistent access to the build infrastructure itself.  \n\n\nAnd if you rotate the attacker's credentials and cut off access, the malware wipes your home directory. Overwrites files so they cannot be recovered. The attacker built this in on purpose so companies think twice before revoking access.  \n\n\nThe group behind this is TeamPCP. Red Hat is their latest target, not their first. Same methods, same playbook, running since late 2025. Confirmed victims: GitHub (3,800 internal repos stolen, listed for sale at $50K), Mistral AI (450 repos, $25K), OpenAI (two employees hit), the European Commission (90+ GB exfiltrated), Eli Lilly ($70K), plus TanStack, UiPath, Zapier, Postman. Fortune 500 banks, a major semiconductor manufacturer, and government agencies confirmed but not named. Total across all waves: 487 confirmed organizations, nearly 300,000 secrets harvested. They are now working with a ransomware group.\n\nThe worm's source code was open-sourced by TeamPCP on May 12. Anyone can build their own version now. Copycats are already active.\n\nSources:\n\n* Red Hat / Miasma attack: Microsoft Threat Intelligence — [https://www.microsoft.com/en-us/security/blog/2026/06/02/preinstall-persistence-inside-red-hat-npm-miasma-credential-stealing-campaign/](https://www.microsoft.com/en-us/security/blog/2026/06/02/preinstall-persistence-inside-red-hat-npm-miasma-credential-stealing-campaign/)\n* Second wave (Phantom Gyp): StepSecurity — [https://www.stepsecurity.io/blog/binding-gyp-npm-supply-chain-attack-spreads-like-worm](https://www.stepsecurity.io/blog/binding-gyp-npm-supply-chain-attack-spreads-like-worm)\n* Editor persistence + cleanup steps: Snyk — [https://snyk.io/blog/miasma-supply-chain-attack-malicious-code-redhat-cloud-services-npm-packages/](https://snyk.io/blog/miasma-supply-chain-attack-malicious-code-redhat-cloud-services-npm-packages/)\n* TeamPCP victims and scope: Tenable — [https://www.tenable.com/blog/mini-shai-hulud-frequently-asked-questions](https://www.tenable.com/blog/mini-shai-hulud-frequently-asked-questions)\n* 2025 secrets stats: GitGuardian State of Secrets Sprawl 2026 — [https://www.gitguardian.com/state-of-secrets-sprawl-report-2026](https://www.gitguardian.com/state-of-secrets-sprawl-report-2026)\n* CISA GovCloud leak: Krebs on Security — [https://krebsonsecurity.com/2026/05/cisa-admin-leaked-aws-govcloud-keys-on-github/](https://krebsonsecurity.com/2026/05/cisa-admin-leaked-aws-govcloud-keys-on-github/)\n\n  \n**If you use npm, i wrote in the comments what to do, in order. Do not skip the order, it matters.**\n\n\n\n--- Top Comments ---\n\n\n[17 upvotes] Check if you installed an affected package. Run npm ls u/redhat-cloud-services, npm ls u/vapi-ai/server-sdk, and npm ls ai-sdk-ollama in your projects. Also check your lockfile for any version published June 1 or June 3-4. If you find one, assume every credential on that machine is already compromised and keep reading.\n\nDo not start by revoking tokens. If the backdoor is still on the machine and it sees its access getting cut, it can wipe your home directory. Clean the machine first, rotate second, in that order.\n\nCheck \\~/.claude/settings.json. Look for anything you did not add, especially SessionStart hooks. If you find something you do not recognize, screenshot it for evidence, disconnect the machine from the network, then remove it. Do not rotate anything from this machine.\n\nCheck .vscode/tasks.json in your projects. Same thing. Look for tasks you did not create, especially anything that runs on folderOpen. Remove them.\n\nCheck your GitHub security log at github.com/settings/security-log. Look for repositories you did not create, especially any with \"Miasma\" or \"Shai-Hulud\" in the description. Look for GitHub Actions workflows or self-hosted runners you did not set up. If you ru\n\n[2 upvotes] Didn't this happen a little while ago, or is this a separate new thing? ",
  "transcript_chars": 6438,
  "ingested_at": "2026-06-08T13:30:04.856047+00:00",
  "source": "reddit",
  "yt_meta": {
    "score": 72,
    "upvote_ratio": 0.94,
    "num_comments": 15,
    "author": "johnypita",
    "is_self": true
  }
}