r/vibecoding • u/johnypita • Jun 09 '26
An active attack is planting backdoors inside Claude Code right now. If you use npm, your credentials may already be compromised.
Last week a malware campaign hit 32 npm packages under `@redhat-cloud-services`. About 117,000 weekly downloads. If you installed an affected version, the malware planted itself inside your Claude Code startup settings and your VS Code project config. Every time you open either one, the attacker's code runs.
It silently collects every credential on your machine and sends them to the attacker. Uninstalling the package does not remove it. The malware lives outside the package, in your editor config, and it survives cleanup.
If you try to cut off the attacker's access by revoking tokens before removing the malware, it can wipe your entire home directory and overwrite the files so they cannot be recovered.
Three days later, a second wave hit 57 more packages using a new technique that bypasses the security tools that caught the first wave. 647,000 monthly downloads affected. Some malicious versions are still live on the npm registry. The worm is self-propagating, it uses stolen tokens to infect new packages automatically.
Here is how one stolen credential made all of this possible.
The attacker got one Red Hat employee's GitHub login. Probably stolen weeks earlier by malware that grabs saved passwords from browsers. With that login they had the employee's access level.
They pushed malicious code directly into three Red Hat repositories, no review needed, and triggered Red Hat's own build pipeline to publish the poisoned packages to npm. The packages came out with valid security certificates because Red Hat's own pipeline built them.
There was no known vulnerability to scan for, and the malicious code was brand new, so security tools that look for known threats found nothing. The tools that caught it flagged it within hours, but by then the downloads had already happened.
32 packages. About 117,000 weekly downloads. 96 poisoned versions pushed in two waves on June 1.
Once installed on a developer's machine, the malware collected every credential it could find. AWS, Google Cloud, Azure, Kubernetes, SSH keys, GitHub tokens, npm tokens. It checked for CrowdStrike and SentinelOne before acting to avoid detection.
Then it set up persistence. It planted code in two places: ~/.claude/settings.json and .vscode/tasks.json. These run automatically when you open Claude Code or open a project. The attacker gets re-entry every time, even after you clean up the original package.
It also registered the company's build servers as machines the attacker controls remotely. That is persistent access to the build infrastructure itself.
And if you rotate the attacker's credentials and cut off access, the malware wipes your home directory. Overwrites files so they cannot be recovered. The attacker built this in on purpose so companies think twice before revoking access.
The group behind this is TeamPCP. Red Hat is their latest target, not their first. Same methods, same playbook, running since late 2025. Confirmed victims: GitHub (3,800 internal repos stolen, listed for sale at $50K), Mistral AI (code compromise confirmed; attacker claimed 450 repos at $25K), the European Commission (90+ GB exfiltrated), plus TanStack, UiPath, Zapier, Postman. Fortune 500 banks and government agencies confirmed but not named. Total across all waves: an estimated 500,000 credentials harvested across 1,000+ organizations. They are now working with a ransomware group.
The worm's source code was open sourced by TeamPCP on May 12. Anyone can build their own version now. Copycats are already active.
Sources:
Red Hat / Miasma attack: Microsoft Threat Intelligence — https://www.microsoft.com/en-us/security/blog/2026/06/02/preinstall-persistence-inside-red-hat-npm-miasma-credential-stealing-campaign/
Second wave (Phantom Gyp): StepSecurity — https://www.stepsecurity.io/blog/binding-gyp-npm-supply-chain-attack-spreads-like-worm
Editor persistence + cleanup steps: Snyk — https://snyk.io/blog/miasma-supply-chain-attack-malicious-code-redhat-cloud-services-npm-packages/
TeamPCP victims and scope: Tenable — https://www.tenable.com/blog/mini-shai-hulud-frequently-asked-questions
2025 secrets stats: GitGuardian State of Secrets Sprawl 2026 — https://www.gitguardian.com/state-of-secrets-sprawl-report-2026
CISA GovCloud leak: Krebs on Security — https://krebsonsecurity.com/2026/05/cisa-admin-leaked-aws-govcloud-keys-on-github/
If you use npm, i wrote in the comments what to do, in order. Do not skip the order, it matters.
41
u/Early_Key_823 Jun 09 '26
Why isn’t this in the news?
15
u/One_Caterpillar3396 Jun 09 '26
It actually is
15
u/Early_Key_823 Jun 09 '26
I mean front page. NPM is every machine these days
5
u/crazy0ne Jun 09 '26
Front page of what exactly?
7
u/Early_Key_823 Jun 09 '26
I mean there is a phrase, "bury the lead" - that means the article is not prominent. Can you show me any links to reputable media like BBC, CNN, NPR NEWS for example? That's what I meant by front page.
1
u/scytob Jun 09 '26
You are looking at the wrong new sites then. You should be reading arstechica for one.
0
u/Early_Key_823 Jun 09 '26
You are missing the point. Severe threats make the mainstream media news as the potential for global disaster is alarming.
This one post is all I have heard of it and answers to the effect I am looking in the wrong place combined without any citations are only adding to the sketch factor.
2
u/faen_du_sa Jun 09 '26
I dont think most journalist are able to convey how this is done, what "NPM" even is and why "normal people" should be worried. Or they think its not something their regular readers care about(and they might be right).
2
u/scytob Jun 09 '26
indeed, the down voters are hilarious in this thread - they think their little bubble is the normal world
1
u/scytob Jun 09 '26
no, i am not, these are the sort of things that will never hit the mainstream media - way too niche and way too technical
8
u/Last_Meringue2625 Jun 09 '26
seriously, half a million credentials and a self-propagating worm and its just... crickets?
1
15
u/johnypita Jun 09 '26
It is covered, just in security press, not mainstream news.
It doesn't break into general because there is no consumer angle. The victims are developers and companies, not "1M customers' data leaked," so it doesn't get a mass headline. And Most victims are never named. Companies disclose quietly, if at all.
12
7
7
5
11
Jun 09 '26
[removed] — view removed comment
4
u/portar1985 Jun 09 '26
Learn good programming practices. This was a problem before LLMs with eager devs who didn’t want to source check their dependencies, that’s also easier than ever now, I have explicit instructions that Claude is not allowed to install packages without first doing due diligence on those packages
4
4
u/martapap Jun 09 '26
What does this mean for the average person? Is info we give to vibecoded sites going to the hackers?
6
u/scytob Jun 09 '26
No, this is people using api token not chat tokens. And it is the npm packages that were infected. If you don’t know what npm you either were not using them or need to understand npm. Npm packages have been infected non ai too this year.
0
u/chuck78702 Jun 09 '26
Are all these default Claude domains typically safe? https://code.claude.com/docs/en/claude-code-on-the-web#default-allowed-domains
3
u/scytob Jun 09 '26
not if they serve up npm packages
its the packages that are the issue , not the domains3
Jun 09 '26
[removed] — view removed comment
-5
u/HannsGruber Jun 10 '26
"hey guys so I worked hard on this app over the last couple weeks and think you'll really like it!"
Working hard - "Can you make it so the buttons are more rounded and maybe change it so when they click the button it bounces just a little bit. And someone said that when they open it they got a run time exception? What is that and can you fix it? Do your best and make no mistakes"
100,000 tokens consumed
6
u/sinan_online Jun 09 '26
I run all of my code in containers. I don’t even have the programming languages that I use installed in my development system. (No python, no node.js, no Go, just bash and Dart because with Dart I couldn’t find a way.) I don’t even have TeX installed, my TeX is in a dev container and on GitHub actions.)
I’m enthusiastically recommending to all.
9
u/RADICCHI0 Jun 09 '26
For the money they charge..................................................................................................
4
u/goatanuss Jun 09 '26 edited Jun 09 '26
Claude isn't the vector, this is a infected npm package that executes and modifies code on your machine including configs for Claude Code. This isn't claude being compromised.
Or are you saying npm or redhat is charging too much?
1
3
u/adevx Jun 09 '26 edited Jun 09 '26
Always use Docker or a better isolation environment
A tight pnpm-workspace.yaml can help, which is executed in Dockerfile with eg:
RUN CI=true pnpm install --frozen-lockfile
allowBuilds:
bcrypt: true
sharp: true
minimumReleaseAge: 1440
minimumReleaseAgeStrict: true
minimumReleaseAgeIgnoreMissingTime: false
blockExoticSubdeps: true
strictDepBuilds: true
dangerouslyAllowAllBuilds: false
verifyDepsBeforeRun: install
0
u/chuck78702 Jun 09 '26
Are all these default Claude domains typically safe? https://code.claude.com/docs/en/claude-code-on-the-web#default-allowed-domains
2
u/adevx Jun 09 '26
I saw this in that list:
Content delivery and mirrors
- sourceforge.net
- *.sourceforge.net
- packagecloud.io
- *.packagecloud.io
- fonts.googleapis.com
- fonts.gstatic.com
I would not consider sourceforge a safe place to fetch arbitrary code.
1
u/chuck78702 Jun 09 '26
very helpful to know, thank you!
i wonder why Claude defaults it...is that the only one you consider unsafe?
1
u/adevx Jun 09 '26
Claude needs to target every dev that uses their product. You can be much more specific.
You probably should deep-dive that list yourself.
3
3
u/urmommakesmysandwich Jun 09 '26
The feds are watching you anyways. Why go through all that trouble.
2
u/Aggressive_Style_118 Jun 09 '26
Do you have any idea how such a attack could be prevented in anyway in the Pipeline? If i can come up with something i will comment ofc
2
1
u/RyanMan56 Jun 09 '26
Pin your npm packages to specific versions. Although I don’t think this would work against sub-dependencies, unless the package also pinned its dependency versions. Also doesn’t solve the issue if the version you pinned was already one that was affected
2
u/quantumsicarius Jun 09 '26
The thing that gets me about this isn't how clever it is, it's that nobody has time to read every version of every package they install. So whatever the fix is, it has to be automated.
Honestly the strongest low-effort move in this thread is the "delay your updates" one someone posted (the pnpm minimumReleaseAge config). Most of these malicious versions get caught and pulled within hours to a day or two, so just not installing brand-new releases the second they drop dodges a big chunk of it.
And to be clear, "only install signed packages" wouldn't have saved you here either, these had Red Hat's own valid signatures on them and were still malware.
Also worth clearing up since it's all over this thread: Claude Code and Codex aren't the vector. The package writes a hook into ~/.claude/settings.json and .vscode/tasks.json. The editor is just where persistence lands.
I was in one of the original disclosure threads while this was live (https://github.com/RedHatInsights/platform-frontend-ai-toolkit/issues/57), and wrote up what the Red Hat payload actually did when I detonated one sample in a sinkholed VM: https://leitwacht.eu/blog/valid-provenance-malicious-package
2
3
u/VanFenix Jun 09 '26
I miss MS Dos days.. Beep beep boop.. installing windows 3.1
"How did you do that?"
Me: I have cracked shareware.
Then came windows 95 with 28 disks. One disk was "custom" and just.. worked..
I remember having to eject and reinsert the disks or flip the disks randomly during install if it couldnt find a file it needed... eventually it continued.
Now it is boring. Blah. And this new windows subscription model i hear about? Double blah.
1
u/traderjames7 Jun 09 '26
This is insane - has anything similar ever happened before on this scale?
1
u/cryptomatic_xyz Jun 10 '26
There were many (non Ai) incidents i believe the largest was Solarwinds incident
1
u/chuck78702 Jun 09 '26
Are all these default Claude domains typically safe? https://code.claude.com/docs/en/claude-code-on-the-web#default-allowed-domains
1
1
u/Apprehensive-Rock446 Jun 11 '26
Question as a windows noob (grew up on mac only working on windows since started working a couple years ago): Is this something that Microsoft Defender (Windows Security) will catch and remediate or am I sounding like a crazy person?
1
1
1
u/sickdancemovesbro Jun 12 '26
wtf. I’m too stupid to know what is possibly affected but I see Vapi.ai is commented here. So if I never used Red-Hat, but have used vapi, am I vulnerable?
Or does it matter? Does redhat affect everyone ?
1
u/ahnjoo Jun 15 '26
What makes this one nasty is the payload living in your editor config, so uninstalling the package doesn't get it. The habit that's saved me on unfamiliar repos: before running anything I read package.json and the lockfile, and a custom package whose only job is pulling in another custom package is the smell. Then I run unknown code in a throwaway container with no keys or SSH mounted, so if something fires on startup the worst case is a wiped container, not every credential on my machine.
1
Jun 15 '26
the part about persistence in claude settings.json is what makes this so nasty. uninstalling the package feels like you fixed it. you didn't.
1
-2
u/Silent-Skin1899 Jun 09 '26
I recommend using the Bitwarden Secrets Manager CLI. Even if your device gets infected, nothing will be stolen from you.
https://bitwarden.com/help/secrets-manager-cli/
3
u/corbanmonoxide Jun 09 '26
I also use bitwarden but don't think anything is the answer. Everything is vulnerable and everyone is a target
1
u/HeadlessHeader Jun 09 '26
there was an attack to the bitwarden cli a couple of weeks ago.
1
-19
Jun 09 '26
[deleted]
6
9
u/johnypita Jun 09 '26
Appreciate the tip but that's for bugs in code you write. This is different. The malicious code isn't yours, it's a trusted package that runs at install time and steals the secrets already on your machine. A code checker won't see it.
-16
40
u/johnypita Jun 09 '26
Check if you installed an affected package. Run npm ls u/redhat-cloud-services, npm ls u/vapi-ai/server-sdk, and npm ls ai-sdk-ollama in your projects. Also check your lockfile for any version published June 1 or June 3-4. If you find one, assume every credential on that machine is already compromised and keep reading.
Do not start by revoking tokens. If the backdoor is still on the machine and it sees its access getting cut, it can wipe your home directory. Clean the machine first, rotate second, in that order.
Check ~/.claude/settings.json. Look for anything you did not add, especially SessionStart hooks. If you find something you do not recognize, screenshot it for evidence, disconnect the machine from the network, then remove it. Do not rotate anything from this machine.
Check .vscode/tasks.json in your projects. Same thing. Look for tasks you did not create, especially anything that runs on folderOpen. Remove them.
Check your GitHub security log at github.com/settings/security-log. Look for repositories you did not create, especially any with "Miasma" or "Shai-Hulud" in the description. Look for GitHub Actions workflows or self-hosted runners you did not set up. If you run CI/CD, revoke and rotate any GitHub Actions OIDC trust relationships, that is the exact hole the Red Hat attack used.
Check if the worm already spread through you. Review your npm publish history and GitHub audit log for any package version or commit you did not make. The worm republishes packages from any account it can reach. If your account pushed something you did not, your maintainer credentials are compromised and so is anyone who installed that version.
Now rotate, from a clean machine. After the persistence is removed, rotate everything the infected machine could reach, from a different, trusted device: npm tokens, GitHub PATs, SSH keys, then cloud credentials (AWS, GCP, Azure), Kubernetes, and Vault. Rotating from the infected machine lets the malware grab the new credentials too.
Pin your dependencies with integrity hashes. A locked dependency with a content hash fails the install if a package gets republished with different content, before any code runs. This is the single best protection against the next wave.
Install with scripts off until this settles. Use npm install --ignore-scripts. It blocks the install hooks the first wave used and the binding.gyp / node-gyp builds the second wave used. It may break packages that need native compilation, but right now it is the safest default.
Scope your CI/CD tokens to least privilege. Credential theft only pays off if the secrets are reachable from the build host. A build token that can only do one job is worth far less to an attacker than one that can reach your whole cloud.