Researchers find packages in the @redhat-cloud-services npm namespace shipped malware that harvests credentials for GitHub Actions, AWS, GCP, Azure, and others
Several packages in the @redhat-cloud-services npm scope were found to carry malicious payloads that fire via a preinstall hook on every npm install.
Lead Source
How this story grew
More
Discussion
TechSnif Coverage
Malware Found Lurking in Red Hat npm Packages Targeting Cloud Creds
Compromised @redhat-cloud-services npm packages deployed credential-stealing malware via sneaky preinstall hooks.
Security researchers at Step Security discovered that multiple packages within the @redhat-cloud-services npm namespace were shipping straight-up malware. The malicious payloads targeted credentials for GitHub Actions, AWS, GCP, and other cloud services.
The attack vector is deviously simple. The compromised packages used npm preinstall hooks — scripts that execute automatically every time a developer runs npm install. No user interaction required beyond the install command itself.
That means any developer or CI/CD pipeline pulling these packages was silently handing over cloud credentials without knowing it. GitHub Actions workflows were particularly at risk, given how deeply they integrate with cloud infrastructure.
The scope of affected packages within the @redhat-cloud-services namespace hasn't been fully detailed, but the implications are ugly. Supply chain attacks through trusted namespaces remain one of the nastiest threats in modern software development.