cyber.hendryadrian.com
Cyber Attack & Data Breach · securityweek.com

Malicious Versions of 32 Red Hat npm Packages Spread Credential-Stealing Worm

· Original article ↗

Summary

Attackers published malicious versions of 32 Red Hat npm packages, distributing a credential-stealing worm. Researchers suspect compromised CI/CD publishing access; Ox Security found 210 repositories containing stolen credentials. Clean versions are available.

Key points

  • Malicious versions of 32 packages in Red Hat’s npm ecosystem were published within 72 seconds; the packages have nearly 10 million collective downloads.
  • Aikido says the attackers likely compromised the CI/CD pipeline and used GitHub Actions OIDC; ReversingLabs believes they had @redhat-cloud-services npm scope credentials.
  • The packages used a preinstall hook to run malware during installation, before the package was imported or used.
  • The payload appears to be a Mini Shai-Hulud variant and was designed to collect GitHub Actions secrets, npm tokens, cloud credentials, Kubernetes and Vault material, SSH keys, and other sensitive files.
  • The malware can exfiltrate collected data and use GitHub as a fallback; Ox Security identified 210 repositories containing stolen credentials, while the full infection scope remains unknown.
  • Red Hat published clean versions and removed the malicious releases. Users are advised to update, rotate potentially exposed credentials, check transitive dependencies, and monitor for anomalous outbound connections.

Article Details

Victim Organization
Red Hat
Incident Type
Software supply-chain attack involving malicious NPM package versions and credential-stealing malware
Data Types Exposed
  • Stolen credentials found in 210 repositories, according to Ox Security
  • The malware was designed to harvest GitHub Actions secrets, npm tokens, cloud credentials, Kubernetes and Vault material, SSH keys, Git credentials, and other sensitive files
Affected Records
Ox Security identified 210 repositories containing stolen credentials; the article says this suggests at least as many developers were infected.
Affected Data Size
Unknown
Operational Impact
Malicious versions of 32 packages were published and later removed from NPM; clean versions were published. The malware could execute during package installation, attempt repository enumeration with stolen GitHub tokens, modify GitHub Actions workflows, and write malicious index.js payloads into repositories/actions. The full scope of infection was unknown.
Ransom Or Extortion
None reported
Claim Status
confirmed

MITRE ATT&CK

T1567.001 · Exfiltration to Code RepositoryThe malware reportedly exfiltrated stolen information by publishing it to newly created public repositories as a GitHub-based fallback.

Threat Actors

TeamPCPThe article says TeamPCP used the Mini Shai-Hulud worm in earlier attacks and that the worm's source code was released by a hacking group. It does not attribute the Red Hat compromise to TeamPCP.

Malware

ChainDropThe payload contains the string “Miasma: The Spreading Blight” and appears to be a variant of the Mini Shai-Hulud worm that TeamPCP used in several attacks against the open source software community over the past months.

Vendors

Red HatOn Monday, hackers hit Red Hat’s NPM repository in a new supply chain attack, publishing malicious versions of 32 packages to distribute a credential-stealing worm.

Products

GitHub ActionsAccording to Aikido, the attackers likely compromised the CI/CD pipeline and used the GitHub Actions OIDC to publish the malicious package versions.npmOn Monday, hackers hit Red Hat’s NPM repository in a new supply chain attack, publishing malicious versions of 32 packages to distribute a credential-stealing worm.

Related Articles