{
  "$type": "site.standard.document",
  "bskyPostRef": {
    "cid": "bafyreib7ham3j7bawttqxdmgiklwr2fcifzgaxk4kn66kbmf5ufq2jwvlm",
    "uri": "at://did:plc:b3tz6srl4ochk2wxn6dv6xpy/app.bsky.feed.post/3mnaeksic5z52"
  },
  "path": "/Articles/1075742/",
  "publishedAt": "2026-06-01T14:05:04.000Z",
  "site": "https://lwn.net",
  "tags": [
    "reporting",
    "blog\npost",
    "@redhat-cloud-services"
  ],
  "textContent": "StepSecurity is reporting that a number of npm packages in the `@redhat-cloud-services` scope include malware that runs automatically on every `npm install`:\n\n> The payload is a multi-stage credential harvester that sweeps GitHub Actions secrets along with AWS, GCP, Azure, Kubernetes, HashiCorp Vault, npm, and CircleCI tokens, and it is purpose-built to evade detection, including an explicit attempt to bypass StepSecurity Harden-Runner.\n>\n> StepSecurity analyzed `@redhat-cloud-services/host-inventory-client@5.0.3` in full. Its `index.js`, executed at install time, is 4.2 MB, a file that should weigh a few kilobytes, with the real payload buried under three separate layers of obfuscation. The malware is also a self-propagating worm: using stolen npm tokens and npm's `bypass_2fa` parameter, it republishes backdoored versions of other packages on its own, even against accounts protected by two-factor authentication, so every infected machine can seed the next wave with no attacker involvement. All affected packages were published via GitHub Actions OIDC from the `RedHatInsights/javascript-clients` repository, indicating the upstream CI/CD pipeline itself was compromised. Analysis of the remaining packages is ongoing.\n\nA blog\npost from SafeDep has additional analysis about the incident. We did not find an advisory from Red Hat on this yet.",
  "title": "Multiple redhat-cloud-services npm packages compromised (StepSecurity Blog)"
}