StepSecurity Details Malware in Red Hat Cloud Services npm Packages

Summary

StepSecurity reports malicious npm releases that execute at install time, harvest credentials, and can republish backdoored packages. Its analysis describes the malware’s techniques, affected versions, and remediation advice.

Key points

StepSecurity says multiple @redhat-cloud-services npm packages contained malicious versions with a preinstall script that runs before application code.
The analysis describes a four-layer obfuscation chain and a 4.2 MB install script; the payload targets secrets in GitHub Actions runner memory and credentials across cloud, developer, and package-registry environments.
Using stolen npm tokens, the malware attempts to publish trojanized packages and uses npm’s bypass_2fa parameter to evade two-factor requirements.
The malware uses api[.]github[.]com for C2 and can place encoded stolen data in victim-controlled GitHub repositories.
The payload also installs Claude Code SessionStart and VS Code folderOpen hooks for persistence; StepSecurity advises affected users to assume compromise and rotate exposed credentials.
StepSecurity says Harden-Runner detected and stopped a runner-memory access attempt in its test workflow; it also published affected package versions and disclosure issues for upstream repositories.

Article Details

Attack Vectors: Compromised @redhat-cloud-services npm packages execute a preinstall script (`node index.js`) automatically during `npm install`, before application code runs.
The article says the affected packages were published through GitHub Actions OIDC from the RedHatInsights/javascript-clients repository, indicating a compromised upstream CI/CD pipeline.
The payload reads Runner.Worker process memory and queries the GitHub Actions runtime API to locate masked secrets, then sweeps credentials and key files from developer and CI environments.
Using harvested npm tokens, the malware attempts to publish trojanized package versions with npm's `bypass_2fa` parameter, enabling self-propagation.
The malware uses GitHub API traffic for C2 and creates refs and commits containing base64-encoded stolen data in victim-controlled repositories for exfiltration.
The payload adds a Claude Code SessionStart hook and a VS Code folderOpen task to trigger attacker-controlled code during normal developer workflows.
The JavaScript payload uses multiple obfuscation layers, including ROT-21 encoding, AES-128-GCM encrypted blobs, a rotated custom-base64 string table, and a custom B5 cipher. The article says C2 domain recovery is still in progress.
Defensive Notes: If an affected package version was installed, treat the CI/CD environment or developer machine as compromised and rotate exposed credentials immediately.
Review environments that installed the listed malicious package versions, including CI/CD pipelines and developer machines, for credential exposure and persistence.
StepSecurity reports that Harden-Runner can monitor process, network, and file activity in GitHub Actions and initiate lockdown when it detects the malicious process reading runner memory.
The article recommends using an npm package cooldown window and compromised-package checks to delay or block newly published malicious versions.