Attackers hijacked Red Hat’s official npm namespace on June 1 to distribute 32 backdoored software packages designed to steal cloud credentials and developer tokens from compromised build pipelines.

Key Points

• Malicious versions of 32 packages within the @redhat-cloud-services scope were published to npm in just 72 seconds.
• The malware, identified as a variant of the Miasma worm, executes automatically during the package installation process.
• Attackers utilized compromised GitHub Actions OIDC tokens to bypass security measures and gain unauthorized access to the build pipeline.
• The stolen credentials include cloud provider keys, CI/CD tokens, and npm access tokens, which the malware uses to attempt further propagation.
• Red Hat has since removed the malicious versions and released clean updates, though affected systems remain at risk of credential exposure.

Why it Matters

This incident highlights a critical vulnerability in "trusted publishing" workflows, where attackers can exploit compromised CI/CD pipelines to distribute malware through legitimate vendor namespaces. Organizations must now treat any system that installed these packages as compromised and rotate all potentially exposed credentials to prevent further unauthorized access.