Dozens of Red Hat packages backdoored through its offical NPM channel

A significant security incident has emerged involving compromised official Red Hat NPM accounts that were exploited to distribute a harmful worm. This worm is capable of infiltrating systems, stealing sensitive credentials, and potentially accessing more confidential data. Reports from the cybersecurity firm Aikido indicate that the supply-chain attack commenced on Monday and continued to pose a threat at the time of reporting. The attack originated from the takeover of the @redhat-cloud-services account, a trusted source for developers utilizing Red Hat cloud services within the npm repository. The method through which the threat actor gained access to this legitimate channel remains unclear, but it likely involved the compromise of necessary credentials, possibly stemming from an earlier supply-chain breach. More than 30 packages appear to have been compromised, executing an obfuscated payload during the npm installation process. This occurs prior to a developer's actual use of the packages in a production environment. A thorough analysis by cybersecurity firm Socket has revealed that the malware is specifically engineered to gather sensitive credentials, including GitHub action secrets, npm tokens, Kubernetes credentials, and various cloud service access keys. Once a device is infected, the worm propagates by republishing the backdoored packages to other third-party accounts that the compromised system can access. Following the incident, most of the affected packages were removed within hours. Researchers at Socket have advised organizations to consider any system that installed one of the affected @redhat-cloud-services package versions as potentially compromised. They emphasized that the malicious payload activates during the npm installation phase, which occurs before the application code uses the package, making exposure reliant on the installation or CI process rather than on runtime usage. Infected systems encrypt stolen credentials and transmit them through web requests. Moreover, the malware has a fallback mechanism that allows it to publish the encrypted data into a compromised GitHub repository if it possesses the necessary credentials.