Red Hat npm namespace compromise: 32 redhat-cloud-services packages backdoored with credential-stealing worm via hijacked GitHub account, 116000 downloads
Developers who installed @redhat-cloud-services npm packages since June 1 should treat their CI and cloud credentials as compromised. Wiz found 32 packages and 96 versions carrying a credential-stealing worm after a Red Hat GitHub account was hijacked. Over 116,000 downloads hit.
Anyone who installed packages from the @redhat-cloud-services npm namespace since June 1 has a problem to deal with this week. Wiz Research identified a supply chain compromise affecting 32 packages across 96 versions, all carrying a multi-stage credential harvester. According to the researchers, the attack began after a Red Hat employee's GitHub account was hijacked, letting the attacker inject malicious GitHub Actions workflows into Red Hat repositories and publish poisoned packages through the CI pipeline rather than a stolen npm token. The malware runs during installation, before any application code, and sweeps GitHub Actions secrets along with AWS, GCP, Azure, Kubernetes, HashiCorp Vault, npm and CircleCI credentials. Cybersecurity Dive reports the affected versions accumulated more than 116,000 downloads, and researchers tie the payload to a variant of the Shai-Hulud worm seen in earlier npm attacks. Red Hat has stated that no Red Hat products or enterprise software shipped with the compromised versions, crediting version pinning by its engineering teams. The practical takeaway for affected teams is direct: rotate cloud credentials, CI secrets, SSH keys and npm tokens, and audit recent builds for anything pulled from that namespace.