Multiple npm packages in the @redhat-cloud-services scope were discovered to contain malware that executes automatically on npm install, according to security analysts [1]. The malicious code acts as a multi-stage credential harvester targeting GitHub Actions secrets and cloud tokens for AWS, Google Cloud Platform, Microsoft Azure, Kubernetes, HashiCorp Vault, npm itself, and CircleCI [1].
Among the compromised packages, @redhat-cloud-services/host-inventory-client version 5.0.3 was found to include a 4.2 MB index.js file with deeply obfuscated malicious code—far larger than expected for such a module [1]. The malware operates as a self-propagating worm, republishing backdoored packages using stolen npm tokens and bypassing two-factor authentication by exploiting npm's bypass_2fa parameter [1].
All affected packages originated from the RedHatInsights/javascript-clients repository and were published through GitHub Actions OpenID Connect (OIDC), suggesting a compromise of the upstream continuous integration and delivery (CI/CD) pipeline [1]. As of now, Red Hat has not released any advisory addressing this security breach [1].
Security firm SafeDep published a detailed blog post analyzing the incident further [1]. The situation remains under investigation, and no public fixes or mitigation steps have been announced yet.