Red Hat npm packages infected with credential stealing worm

A sophisticated software supply chain attack has compromised official Red Hat packages on the npm registry, distributing a credential-stealing worm to developers. The incident, which began on June 1, 2026, involved the publication of malicious versions of at least 32 packages under the trusted redhatcloudservices namespace.

Security researchers analyzing the attack report that an attacker gained control of a Red Hat employee's GitHub account and used it to push malicious code directly to internal repositories. This access allowed the threat actor to compromise the continuous integration and delivery (CI/CD) pipeline. The attacker then leveraged GitHub Actions and OpenID Connect (OIDC) tokens—a security feature designed for "trusted publishing"—to automatically push backdoored versions of the legitimate packages to the npm registry within a 72-second window.

The compromised packages, which span Red Hat's Hybrid Cloud Console ecosystem and collectively see hundreds of thousands of weekly downloads, contained a malicious pre-install script. This script automatically executed a heavily obfuscated payload during the npm install process, before any application code runs, meaning...