ReversingLabs Finds 32 Backdoored Red Hat npm Packages Published in 72 Seconds

Jun 1, 2026 · Original article ↗

Summary

ReversingLabs says 32 malicious @redhat-cloud-services npm versions were published in 72 seconds on June 1, 2026. Its analysis found an obfuscated preinstall credential stealer; clean versions were published and the malicious versions removed.

Key points

ReversingLabs reported 32 malicious package versions published within 72 seconds, representing approximately 9.8 million total downloads across the affected ecosystem.
The packages added a preinstall script that ran a replaced, obfuscated index.js during installation.
Analysis of the chrome package payload found collection of cloud, developer, npm, and SSH credentials, with a separate exfiltration path for GitHub Actions environments.
The loader used ROT-N encoding, AES-128-GCM encryption, and obfuscator.io obfuscation, and downloaded the Bun runtime to execute the main payload.
The payload contained logic that could use stolen npm credentials to publish malicious package versions elsewhere; the article does not report that further propagation occurred.
Researchers inferred that the attacker had credentials for the npm scope because affected packages spanned two GitHub source repositories.
Clean follow-up versions were published and the malicious versions removed. ReversingLabs advises affected users to rotate accessible secrets, check lockfiles, and investigate build environments used during the exposure window.

Article Details

Attack Vectors: An attacker published malicious versions of 32 packages in the @redhat-cloud-services npm scope within a 72-second window. The article assesses that the attacker had access to scope-level npm credentials; it does not identify the attacker.
Each affected package added a preinstall script that ran index.js during npm install, where the file had been replaced with an obfuscated loader.
The loader used ROT-N encoding, AES-128-GCM encrypted blobs, and obfuscator.io obfuscation. One blob downloaded Bun when it was not already present; the other contained the payload, which was executed with Bun.
The payload harvested cloud, GitHub, npm, and SSH credentials from environment variables and local files, including ~/.npmrc and ~/.ssh/.
The payload checked GITHUB_REPOSITORY and GITHUB_WORKFLOW_REF to identify GitHub Actions environments and used a targeted exfiltration path. Stolen data was reported to be exfiltrated through the GitHub API.
The payload contained functions structurally similar to those used to encode the compromised packages. ReversingLabs assessed that it could generate and publish malicious package versions using stolen npm credentials; the article does not confirm that further propagation occurred.
Defensive Notes: If npm install was run during the stated June 1, 2026 attack window with an affected package in the dependency tree, treat the build environment as compromised.
Rotate credentials, tokens, SSH keys, and secrets accessible to affected environments, including cloud, HashiCorp Vault, GitHub, and npm credentials.
Check package-lock.json and yarn.lock for the affected package versions, including transitive dependencies.
Block the malicious package hashes in artifact proxies and investigate CI/CD jobs that ran during the exposure window.
Monitor build agents for anomalous outbound HTTP connections initiated during npm install, particularly from Node.js processes.

Indicators of compromise

Type	Indicator	Context
SHA256	`080190bffcaafffacca1f0181fc9024aaaa21500ffdc9926fa5b689ba959965d`	SHA-256 of the malicious index.js in the compromised @redhat-cloud-services/frontend-components-notifications package.
SHA256	`09b2301d1589416e0d5fb7a602427a9850dee6713ffa741c0efcfeb1eb4c8952`	SHA-256 of the malicious index.js in the compromised @redhat-cloud-services/javascript-clients-shared package.
SHA256	`17c4312b50d69a6f61515edcf71cfaa8271fe2538b942128cfb639d021d042a7`	SHA-256 of the malicious index.js in the compromised @redhat-cloud-services/frontend-components-testing package.
SHA256	`1a30a9abe20bab121aaa75ed040565af14e6cdfb745609ee0e7b94a2d814fb9c`	SHA-256 of the malicious index.js in the compromised @redhat-cloud-services/rule-components package.
SHA256	`21b6409a7b84446310daca5409ad6112ac60a1e4bef97736e53fff5f63bfdef4`	SHA-256 of the malicious index.js in the compromised @redhat-cloud-services/chrome package.
SHA256	`2a446171b4b981d98b5af6c5606bd63b1570040334210b6ab0a10901b2606fe5`	SHA-256 of the malicious index.js in the compromised @redhat-cloud-services/entitlements-client package.
SHA256	`396cac9e457ec54ff6d3f6311cb5cc1da8054d019ce3ffa1de5741506c7a4ea4`	SHA-256 of the malicious index.js in the compromised @redhat-cloud-services/remediations-client package.
SHA256	`3f8e522595f32277a0013c7ab0df3ecf336460b56e6b4be9130907f419db3b6d`	SHA-256 of the malicious index.js in the compromised @redhat-cloud-services/frontend-components package.
SHA256	`42e165602967c8e1a6fae0113a5179adbe33e18192244fe34b872db09c85e0e6`	SHA-256 of the malicious index.js in the compromised @redhat-cloud-services/integrations-client package.
SHA256	`545a1838c66e1771f58d84a17b3e1841e5eeab91a73f4ccc59c9492450a6d9c0`	SHA-256 of the malicious index.js in the compromised @redhat-cloud-services/frontend-components-config package.
SHA256	`5c6cb758a3447bc7e0de34406919a933f9351e90ef04ec43f3bbb401e7004e1b`	SHA-256 of the malicious index.js in the compromised @redhat-cloud-services/compliance-client package.
SHA256	`5dabf08e2655c012e478074a2cea2b0d34e286c27265a26f3846fc45e5584501`	SHA-256 of the malicious index.js in the compromised @redhat-cloud-services/config-manager-client package.
SHA256	`7b19ffc2f2bfff75989255e5e807d0f62513153de287eba9cc17003c1dcae8a8`	SHA-256 of the malicious index.js in the compromised @redhat-cloud-services/quickstarts-client package.
SHA256	`7cbace2a186cab2c652305b6e33c8eeb10d4a0ec3a0c8b795de012094fa0d845`	SHA-256 of the malicious index.js in the compromised @redhat-cloud-services/hcc-kessel-mcp package.
SHA256	`85b1ed56530bb64d925af4ca50faacd89efb1b63d615238a34adbea9f00e4754`	SHA-256 of the malicious index.js in the compromised @redhat-cloud-services/notifications-client package.
SHA256	`89f97557200bd26cc8941c9abaadac2d798a89562401016fbb2c757e3092dfdc`	SHA-256 of the malicious index.js in the compromised @redhat-cloud-services/frontend-components-utilities package.
SHA256	`8d2a09b3727b50f3d035b58bd35b90b504d24dda73a8a24e926a010a58ba5f74`	SHA-256 of the malicious index.js in the compromised @redhat-cloud-services/insights-client package.
SHA256	`94e8488fd033728eee6666550d5a94b0cc1f7b231d4d85d0affecb0615116722`	SHA-256 of the malicious index.js in the compromised @redhat-cloud-services/rbac-client package.
SHA256	`9b99482b75ee89f0d916f2743deeff381ea727e69c71491822477e67891841ad`	SHA-256 of the malicious index.js in the compromised @redhat-cloud-services/frontend-components-remediations package.
SHA256	`b390d9f708760b799ee5482e8050ce093219140627fcaec6df8812ac9abb9a9b`	SHA-256 of the malicious index.js in the compromised @redhat-cloud-services/tsc-transform-imports package.
SHA256	`b86c5ae9e95bd841a595440faa3eb6317441e746f241ae8fd641ab59ed1d1966`	SHA-256 of the malicious index.js in the compromised @redhat-cloud-services/types package.
SHA256	`c2a60face766f69f82c972375f35f8ebaa45d6c464176974e631d9a78d6bea0a`	SHA-256 of the malicious index.js in the compromised @redhat-cloud-services/frontend-components-config-utilities package.
SHA256	`cffc487ee978f7bc06e3856b286940940658884847d38b619a137b8272a75980`	SHA-256 of the malicious index.js in the compromised @redhat-cloud-services/host-inventory-client package.
SHA256	`d1999fd543085918dd542322c6455abde3c57a93b8f7ce871b8809c8bb744af7`	SHA-256 of the malicious index.js in the compromised @redhat-cloud-services/vulnerabilities-client package.
SHA256	`d8d170af3de17bb9b217c52aaaffdf9395f35ef015a57ef676e406c121e5e223`	SHA-256 of the malicious index.js in the compromised @redhat-cloud-services/frontend-components-advisor-components package.
SHA256	`df1732f5bfec12e066be44dee02ec8a243e4868d38672c1b1d065359dd735a14`	SHA-256 of the malicious index.js in the compromised @redhat-cloud-services/patch-client package.
SHA256	`e5f73c888f1250a8895680801975cf177e8c690defd4a999e56f6c08ff64deb8`	SHA-256 of the malicious index.js in the compromised @redhat-cloud-services/frontend-components-translations package.
SHA256	`edd86c0efd776a6bd934fc7b0d4d6da2b256e147cfa83bb0c2814e81d849c427`	SHA-256 of the malicious index.js in the compromised @redhat-cloud-services/eslint-config-redhat-cloud-services package.
SHA256	`f961d6897c0ec586cde633e100865b5b1d435cc7c301dbf0f41298ca5b42e17a`	SHA-256 of the malicious index.js in the compromised @redhat-cloud-services/sources-client package.