{"id":26204,"date":"2026-09-21T15:15:31","date_gmt":"2026-09-21T23:15:31","guid":{"rendered":"https:\/\/www.palada.net\/index.php\/2026\/09\/21\/31-red-hat-npm-packages-backdoored-by-miasma-in-72-seconds\/"},"modified":"2026-09-21T15:15:31","modified_gmt":"2026-09-21T23:15:31","slug":"31-red-hat-npm-packages-backdoored-by-miasma-in-72-seconds","status":"publish","type":"post","link":"http:\/\/www.palada.net\/index.php\/2026\/09\/21\/31-red-hat-npm-packages-backdoored-by-miasma-in-72-seconds\/","title":{"rendered":"31 Red Hat npm packages backdoored by Miasma in 72 seconds"},"content":{"rendered":"<div class=\"rich-text_richText__UyrDZ\" data-anchor-headings=\"true\" data-component=\"rich-text\" data-reader-view=\"false\">\n<div class=\"payload-richtext\">\n<p>RL researchers have uncovered a large-scale, coordinated supply chain attack targeting the <em>@redhat-cloud-services<\/em> npm scope. On June 1, an attacker published malicious versions of 31 packages (update) in a 72-second window, injecting obfuscated preinstall malware into every one. <\/p>\n<p>The affected packages collectively represent approximately 9.8 million total downloads and cover the full breadth of Red Hat&#8217;s Hybrid Cloud Console JavaScript ecosystem \u2014 UI components, API clients, build tooling, configuration utilities, and MCP servers.<\/p>\n<p>Since this post was first published, there are important updates, including:<\/p>\n<ul class=\"list-bullet\">\n<li class=\"\" value=\"1\">The attack has been named and attributed. <\/li>\n<li class=\"\" value=\"2\">Root cause is more specific than scope-level credential theft. <\/li>\n<li class=\"\" value=\"3\">Valid SLSA provenance. <\/li>\n<li class=\"\" value=\"4\">Second wave \/ package count discrepancy. <\/li>\n<li class=\"\" value=\"5\">Broader TeamPCP campaign context. <\/li>\n<li class=\"\" value=\"6\">Red Hat officially closed the incident. <\/li>\n<li class=\"\" value=\"7\">New payload capability: cloud identity enumeration. <\/li>\n<\/ul>\n<p>See <a href=\"https:\/\/www.reversinglabs.com\/blog\/red-hat-cloud-service-npm-packages-backdoored-in-72-seconds#updates\">details of the updates<\/a> at the bottom of the post.<\/p>\n<h3><strong>Scale of the attack<\/strong><\/h3>\n<div class=\"lexical-table-container\">\n<table class=\"lexical-table\" style=\"border-collapse:collapse\">\n<tbody>\n<tr class=\"lexical-table-row\">\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p style=\"text-align:center\"><strong>Package<\/strong><\/p>\n<\/td>\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p style=\"text-align:center\"><strong>Malicious Version<\/strong><\/p>\n<\/td>\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p style=\"text-align:center\"><strong>Published (UTC)<\/strong><\/p>\n<\/td>\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p style=\"text-align:center\"><strong>Total Downloads<\/strong><\/p>\n<\/td>\n<\/tr>\n<tr class=\"lexical-table-row\">\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p><a href=\"https:\/\/secure.software\/npm\/packages\/@redhat-cloud-services\/tsc-transform-imports\"><span style=\"text-decoration:underline\">@redhat-cloud-services\/tsc-transform-imports<\/span><\/a><\/p>\n<\/td>\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p>1.2.2<\/p>\n<\/td>\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p>10:54:09<\/p>\n<\/td>\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p>335,889<\/p>\n<\/td>\n<\/tr>\n<tr class=\"lexical-table-row\">\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p><a href=\"https:\/\/secure.software\/npm\/packages\/@redhat-cloud-services\/types\"><span style=\"text-decoration:underline\">@redhat-cloud-services\/types<\/span><\/a><\/p>\n<\/td>\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p>3.6.1<\/p>\n<\/td>\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p>10:54:09<\/p>\n<\/td>\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p>1,281,228<\/p>\n<\/td>\n<\/tr>\n<tr class=\"lexical-table-row\">\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p><a href=\"https:\/\/secure.software\/npm\/packages\/@redhat-cloud-services\/eslint-config-redhat-cloud-services\"><span style=\"text-decoration:underline\">@redhat-cloud-services\/eslint-config-redhat-cloud-services<\/span><\/a><\/p>\n<\/td>\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p>3.2.1<\/p>\n<\/td>\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p>10:54:20<\/p>\n<\/td>\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p>487,137<\/p>\n<\/td>\n<\/tr>\n<tr class=\"lexical-table-row\">\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p><a href=\"https:\/\/secure.software\/npm\/packages\/@redhat-cloud-services\/entitlements-client\"><span style=\"text-decoration:underline\">@redhat-cloud-services\/entitlements-client<\/span><\/a><\/p>\n<\/td>\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p>4.0.11<\/p>\n<\/td>\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p>10:54:20<\/p>\n<\/td>\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p>80,714<\/p>\n<\/td>\n<\/tr>\n<tr class=\"lexical-table-row\">\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p><a href=\"https:\/\/secure.software\/npm\/packages\/@redhat-cloud-services\/frontend-components-testing\"><span style=\"text-decoration:underline\">@redhat-cloud-services\/frontend-components-testing<\/span><\/a><\/p>\n<\/td>\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p>1.2.1<\/p>\n<\/td>\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p>10:54:21<\/p>\n<\/td>\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p>13,405<\/p>\n<\/td>\n<\/tr>\n<tr class=\"lexical-table-row\">\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p><a href=\"https:\/\/secure.software\/npm\/packages\/@redhat-cloud-services\/javascript-clients-shared\"><span style=\"text-decoration:underline\">@redhat-cloud-services\/javascript-clients-shared<\/span><\/a><\/p>\n<\/td>\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p>2.0.8<\/p>\n<\/td>\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p>10:54:26<\/p>\n<\/td>\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p>507,613<\/p>\n<\/td>\n<\/tr>\n<tr class=\"lexical-table-row\">\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p><a href=\"https:\/\/secure.software\/npm\/packages\/@redhat-cloud-services\/config-manager-client\"><span style=\"text-decoration:underline\">@redhat-cloud-services\/config-manager-client<\/span><\/a><\/p>\n<\/td>\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p>5.0.4<\/p>\n<\/td>\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p>10:54:25<\/p>\n<\/td>\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p>12,448<\/p>\n<\/td>\n<\/tr>\n<tr class=\"lexical-table-row\">\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p><a href=\"https:\/\/secure.software\/npm\/packages\/@redhat-cloud-services\/hcc-kessel-mcp\"><span style=\"text-decoration:underline\">@redhat-cloud-services\/hcc-kessel-mcp<\/span><\/a><\/p>\n<\/td>\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p>0.3.1<\/p>\n<\/td>\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p>10:54:26<\/p>\n<\/td>\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p>736<\/p>\n<\/td>\n<\/tr>\n<tr class=\"lexical-table-row\">\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p><a href=\"https:\/\/secure.software\/npm\/packages\/@redhat-cloud-services\/frontend-components-remediations\"><span style=\"text-decoration:underline\">@redhat-cloud-services\/frontend-components-remediations<\/span><\/a><\/p>\n<\/td>\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p>4.9.2<\/p>\n<\/td>\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p>10:54:26<\/p>\n<\/td>\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p>112,034<\/p>\n<\/td>\n<\/tr>\n<tr class=\"lexical-table-row\">\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p><a href=\"https:\/\/secure.software\/npm\/packages\/@redhat-cloud-services\/hcc-feo-mcp\"><span style=\"text-decoration:underline\">@redhat-cloud-services\/hcc-feo-mcp<\/span><\/a><\/p>\n<\/td>\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p>0.3.1<\/p>\n<\/td>\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p>10:54:27<\/p>\n<\/td>\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p>1,324<\/p>\n<\/td>\n<\/tr>\n<tr class=\"lexical-table-row\">\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p><a href=\"https:\/\/secure.software\/npm\/packages\/@redhat-cloud-services\/hcc-pf-mcp\"><span style=\"text-decoration:underline\">@redhat-cloud-services\/hcc-pf-mcp<\/span><\/a><\/p>\n<\/td>\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p>0.6.1<\/p>\n<\/td>\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p>10:54:27<\/p>\n<\/td>\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p>3,415<\/p>\n<\/td>\n<\/tr>\n<tr class=\"lexical-table-row\">\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p><a href=\"https:\/\/secure.software\/npm\/packages\/@redhat-cloud-services\/quickstarts-client\"><span style=\"text-decoration:underline\">@redhat-cloud-services\/quickstarts-client<\/span><\/a><\/p>\n<\/td>\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p>4.0.11<\/p>\n<\/td>\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p>10:54:31<\/p>\n<\/td>\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p>5,729<\/p>\n<\/td>\n<\/tr>\n<tr class=\"lexical-table-row\">\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p><a href=\"https:\/\/secure.software\/npm\/packages\/@redhat-cloud-services\/chrome\"><span style=\"text-decoration:underline\">@redhat-cloud-services\/chrome<\/span><\/a><\/p>\n<\/td>\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p>2.3.1<\/p>\n<\/td>\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p>10:54:42<\/p>\n<\/td>\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p>56,869<\/p>\n<\/td>\n<\/tr>\n<tr class=\"lexical-table-row\">\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p><a href=\"https:\/\/secure.software\/npm\/packages\/@redhat-cloud-services\/frontend-components-config\"><span style=\"text-decoration:underline\">@redhat-cloud-services\/frontend-components-config<\/span><\/a><\/p>\n<\/td>\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p>6.11.3<\/p>\n<\/td>\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p>10:54:36<\/p>\n<\/td>\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p>788,862<\/p>\n<\/td>\n<\/tr>\n<tr class=\"lexical-table-row\">\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p><a href=\"https:\/\/secure.software\/npm\/packages\/@redhat-cloud-services\/frontend-components-config-utilities\"><span style=\"text-decoration:underline\">@redhat-cloud-services\/frontend-components-config-utilities<\/span><\/a><\/p>\n<\/td>\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p>4.11.2<\/p>\n<\/td>\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p>10:54:36<\/p>\n<\/td>\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p>874,609<\/p>\n<\/td>\n<\/tr>\n<tr class=\"lexical-table-row\">\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p><a href=\"https:\/\/secure.software\/npm\/packages\/@redhat-cloud-services\/integrations-client\"><span style=\"text-decoration:underline\">@redhat-cloud-services\/integrations-client<\/span><\/a><\/p>\n<\/td>\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p>6.0.4<\/p>\n<\/td>\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p>10:54:36<\/p>\n<\/td>\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p>7,762<\/p>\n<\/td>\n<\/tr>\n<tr class=\"lexical-table-row\">\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p><a href=\"https:\/\/secure.software\/npm\/packages\/@redhat-cloud-services\/frontend-components-translations\"><span style=\"text-decoration:underline\">@redhat-cloud-services\/frontend-components-translations<\/span><\/a><\/p>\n<\/td>\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p>4.4.1<\/p>\n<\/td>\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p>10:54:47<\/p>\n<\/td>\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p>112,768<\/p>\n<\/td>\n<\/tr>\n<tr class=\"lexical-table-row\">\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p><a href=\"https:\/\/secure.software\/npm\/packages\/@redhat-cloud-services\/frontend-components-notifications\"><span style=\"text-decoration:underline\">@redhat-cloud-services\/frontend-components-notifications<\/span><\/a><\/p>\n<\/td>\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p>6.9.2<\/p>\n<\/td>\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p>10:54:53<\/p>\n<\/td>\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p>701,097<\/p>\n<\/td>\n<\/tr>\n<tr class=\"lexical-table-row\">\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p><a href=\"https:\/\/secure.software\/npm\/packages\/@redhat-cloud-services\/frontend-components-advisor-components\"><span style=\"text-decoration:underline\">@redhat-cloud-services\/frontend-components-advisor-components<\/span><\/a><\/p>\n<\/td>\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p>3.8.2<\/p>\n<\/td>\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p>10:54:58<\/p>\n<\/td>\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p>28,616<\/p>\n<\/td>\n<\/tr>\n<tr class=\"lexical-table-row\">\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p><a href=\"https:\/\/secure.software\/npm\/packages\/@redhat-cloud-services\/notifications-client\"><span style=\"text-decoration:underline\">@redhat-cloud-services\/notifications-client<\/span><\/a><\/p>\n<\/td>\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p>6.1.4<\/p>\n<\/td>\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p>10:54:58<\/p>\n<\/td>\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p>24,738<\/p>\n<\/td>\n<\/tr>\n<tr class=\"lexical-table-row\">\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p><a href=\"https:\/\/secure.software\/npm\/packages\/@redhat-cloud-services\/frontend-components\"><span style=\"text-decoration:underline\">@redhat-cloud-services\/frontend-components<\/span><\/a><\/p>\n<\/td>\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p>7.7.2<\/p>\n<\/td>\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p>10:55:00<\/p>\n<\/td>\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p>1,353,473<\/p>\n<\/td>\n<\/tr>\n<tr class=\"lexical-table-row\">\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p><a href=\"https:\/\/secure.software\/npm\/packages\/@redhat-cloud-services\/frontend-components-utilities\"><span style=\"text-decoration:underline\">@redhat-cloud-services\/frontend-components-utilities<\/span><\/a><\/p>\n<\/td>\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p>7.4.1<\/p>\n<\/td>\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p>10:54:59<\/p>\n<\/td>\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p>1,491,890<\/p>\n<\/td>\n<\/tr>\n<tr class=\"lexical-table-row\">\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p><a href=\"https:\/\/secure.software\/npm\/packages\/@redhat-cloud-services\/remediations-client\"><span style=\"text-decoration:underline\">@redhat-cloud-services\/remediations-client<\/span><\/a><\/p>\n<\/td>\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p>4.0.4<\/p>\n<\/td>\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p>10:54:59<\/p>\n<\/td>\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p>38,925<\/p>\n<\/td>\n<\/tr>\n<tr class=\"lexical-table-row\">\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p><a href=\"https:\/\/secure.software\/npm\/packages\/@redhat-cloud-services\/rule-components\"><span style=\"text-decoration:underline\">@redhat-cloud-services\/rule-components<\/span><\/a><\/p>\n<\/td>\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p>4.7.2<\/p>\n<\/td>\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p>10:54:59<\/p>\n<\/td>\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p>157,274<\/p>\n<\/td>\n<\/tr>\n<tr class=\"lexical-table-row\">\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p><a href=\"https:\/\/secure.software\/npm\/packages\/@redhat-cloud-services\/sources-client\"><span style=\"text-decoration:underline\">@redhat-cloud-services\/sources-client<\/span><\/a><\/p>\n<\/td>\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p>3.0.10<\/p>\n<\/td>\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p>10:55:04<\/p>\n<\/td>\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p>44,801<\/p>\n<\/td>\n<\/tr>\n<tr class=\"lexical-table-row\">\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p><a href=\"https:\/\/secure.software\/npm\/packages\/@redhat-cloud-services\/host-inventory-client\"><span style=\"text-decoration:underline\">@redhat-cloud-services\/host-inventory-client<\/span><\/a><\/p>\n<\/td>\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p>5.0.3<\/p>\n<\/td>\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p>10:55:09<\/p>\n<\/td>\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p>226,677<\/p>\n<\/td>\n<\/tr>\n<tr class=\"lexical-table-row\">\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p><a href=\"https:\/\/secure.software\/npm\/packages\/@redhat-cloud-services\/patch-client\"><span style=\"text-decoration:underline\">@redhat-cloud-services\/patch-client<\/span><\/a><\/p>\n<\/td>\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p>4.0.4<\/p>\n<\/td>\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p>10:55:09<\/p>\n<\/td>\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p>15,442<\/p>\n<\/td>\n<\/tr>\n<tr class=\"lexical-table-row\">\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p><a href=\"https:\/\/secure.software\/npm\/packages\/@redhat-cloud-services\/vulnerabilities-client\"><span style=\"text-decoration:underline\">@redhat-cloud-services\/vulnerabilities-client<\/span><\/a><\/p>\n<\/td>\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p>2.1.8<\/p>\n<\/td>\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p>10:55:10<\/p>\n<\/td>\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p>48,286<\/p>\n<\/td>\n<\/tr>\n<tr class=\"lexical-table-row\">\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p><a href=\"https:\/\/secure.software\/npm\/packages\/@redhat-cloud-services\/compliance-client\"><span style=\"text-decoration:underline\">@redhat-cloud-services\/compliance-client<\/span><\/a><\/p>\n<\/td>\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p>4.0.3<\/p>\n<\/td>\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p>10:55:21<\/p>\n<\/td>\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p>11,302<\/p>\n<\/td>\n<\/tr>\n<tr class=\"lexical-table-row\">\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p><a href=\"https:\/\/secure.software\/npm\/packages\/@redhat-cloud-services\/insights-client\"><span style=\"text-decoration:underline\">@redhat-cloud-services\/insights-client<\/span><\/a><\/p>\n<\/td>\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p>4.0.4<\/p>\n<\/td>\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p>10:55:21<\/p>\n<\/td>\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p>31,116<\/p>\n<\/td>\n<\/tr>\n<tr class=\"lexical-table-row\">\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p><a href=\"https:\/\/secure.software\/npm\/packages\/@redhat-cloud-services\/rbac-client\"><span style=\"text-decoration:underline\">@redhat-cloud-services\/rbac-client<\/span><\/a><\/p>\n<\/td>\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p>9.0.3<\/p>\n<\/td>\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p>10:55:21<\/p>\n<\/td>\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p>942,556<\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<p><em><strong>Total: 31 packages, ~9.8 million downloads<\/strong><\/em><\/p>\n<h3><strong>The 72-second window<\/strong><\/h3>\n<p>The malicious versions span from 10:54:09 to 10:55:21 UTC \u2014 72 seconds from first to last publish. This is not a human typing at a terminal; it is automated scripted publishing. The attacker prepared all 31 poisoned archives in advance and executed a single batch push.<\/p>\n<p>The packages span two different GitHub source repositories \u2014 <em>RedHatInsights\/frontend-components<\/em> and <em>RedHatInsights\/javascript-clients<\/em> \u2014 confirming that the attacker had access to the <em>@redhat-cloud-services<\/em> npm scope credentials directly, not to any individual repository. This is a scope-level account compromise.<\/p>\n<h3><strong>What changed in every package<\/strong><\/h3>\n<p>The modification is identical across all 31 packages: exactly two files changed compared to the prior clean version.<\/p>\n<p><em><strong>package.json<\/strong><\/em> \u2014 a <em>preinstall<\/em> script entry is added, pointing execution at index.js:<\/p>\n<div class=\"p code-block_codeBlock__uEaiL\" data-component=\"code-block\">\n<pre><code>json\n\"scripts\": {\n\u00a0\u00a0\"preinstall\": \"node index.js\"\n}<\/code><\/pre>\n<\/div>\n<p><em><strong>index.js<\/strong><\/em> \u2014 the package&#8217;s main entry point is completely replaced with a malicious payload. In the clean referential versions, index.js contains the package&#8217;s normal JavaScript exports. In the malicious versions, it is a single-line obfuscated dropper.<\/p>\n<p>No other files are touched. The surgical precision \u2014 two files, same modification pattern, 31 packages \u2014 is another indicator of automated tooling.<\/p>\n<h3><strong>The obfuscation technique: ROT-N + AES-128-GCM + obfuscator.io<\/strong><\/h3>\n<p>Each malicious index.js follows the same outer structure \u2014 but what it conceals is a three-layer attack pipeline.<\/p>\n<p><strong>Outer wrapper:<\/strong><\/p>\n<div class=\"p code-block_codeBlock__uEaiL\" data-component=\"code-block\">\n<pre><code>javascript\ntry{eval(function(s,n){\n\u00a0\u00a0return s.replace(\/[a-zA-Z]\/g, function(c) {\n\u00a0\u00a0\u00a0\u00a0var b = c &lt;= \"Z\" ? 65 : 97;\n\u00a0\u00a0\u00a0\u00a0return String.fromCharCode((c.charCodeAt(0) - b + n) % 26 + b)\n\u00a0\u00a0})\n}([\/* ~500,000 integer char codes *\/].map(function(c){return String.fromCharCode(c)}).join(\"\"), \/* N *\/))\n}catch(e){console.log(\"wrapper:\",e.message||e)}<\/code><\/pre>\n<\/div>\n<p><strong>Layer 1 \u2014 ROT-N caesar cipher.<\/strong> The outer call encodes ~4 MB of character codes. String.fromCharCode reconstructs a string, then the function(s,n) applies a ROT-N rotation to all alphabetic characters. The rotation value N differs per package \u2014 making each blob visually distinct while using the same decode engine. For the chrome package, N = 3.<\/p>\n<p><strong>Layer 2 \u2014 AES-128-GCM decryption (two blobs).<\/strong> The ROT-decoded string is an async IIFE that decrypts two encrypted blobs using Node.js&#8217;s <em>crypto.createDecipheriv <\/em>(<em>aes-128-gcm<\/em>, &#8230;):<\/p>\n<div class=\"p code-block_codeBlock__uEaiL\" data-component=\"code-block\">\n<pre><code>javascript\n(async()=&gt;{try{\nconst _c = await import(\"node:crypto\");\nconst _d = (k, i, a, c) =&gt; {\n\u00a0\u00a0const d = _c.createDecipheriv(\"aes-128-gcm\", Buffer.from(k,\"hex\"), Buffer.from(i,\"hex\"), {authTagLength:16});\n\u00a0\u00a0d.setAuthTag(Buffer.from(a,\"hex\"));\n\u00a0\u00a0return Buffer.concat([d.update(Buffer.from(c,\"hex\")), d.final()])\n};\nconst _b = _d(key_b, iv_b, tag_b, ciphertext_b);\u00a0 \/\/ bun downloader\nconst _p = _d(key_p, iv_p, tag_p, ciphertext_p);\u00a0 \/\/ main payload<\/code><\/pre>\n<\/div>\n<p>GCM (Galois\/Counter Mode) provides authenticated encryption: any tampering with the ciphertext causes decryption to fail, protecting the payload from modification. Keys, IVs, and auth tags are unique per package.<\/p>\n<p><strong>_b \u2014 bun runtime downloader.<\/strong> The first blob decrypts to JavaScript that downloads the bun runtime (v1.3.13) from <em>github.com\/oven-sh\/bun\/releases<\/em> into a temp directory, makes it executable, and stores the path as <em>globalThis.getBunPath<\/em>. This is a legitimate binary from a legitimate source \u2014 a deliberate choice to avoid suspicious network traffic.<\/p>\n<p><strong>Layer 3 \u2014 Obfuscator.io payload (<\/strong><em><strong>_p<\/strong><\/em><strong>, 634 KB).<\/strong> The second blob \u2014 the actual payload \u2014 is written to a temp file and executed with bun. If bun is already present in the environment, it is used directly. <em>Otherwise _b<\/em> is eval&#8217;d first. After execution the temp file is deleted. The 634 KB payload is heavily obfuscated using the obfuscator.io toolchain (string array encoding, control flow flattening, identifier mangling).<\/p>\n<p>The <em>try\/catch<\/em> at every layer ensures silent execution: if any stage fails for any reason, no error surfaces in the build log.<\/p>\n<p>Critically, every one of the 31 index.js files carries a unique SHA-256 hash. The attacker generated individually tailored payloads \u2014 rotation values, AES keys, IVs, auth tags, and ciphertexts all differ across packages. This defeats hash-based deduplication and means each package must be analyzed independently.<\/p>\n<h2 id=\"what-the-chrome-payload-does\">What the chrome payload does<\/h2>\n<p>Full decryption of the <em>chrome<\/em> package payload reveals a cloud credential stealer with worm propagation capabilities. The <em>_p<\/em> blob is a 634 KB bundled JavaScript program that performs several distinct functions when run with the bun runtime.<\/p>\n<p><strong>Credential harvesting.<\/strong> The payload reads and exfiltrates credentials from the developer&#8217;s build environment via multiple collectors. Confirmed targets include:<\/p>\n<div class=\"lexical-table-container\">\n<table class=\"lexical-table\" style=\"border-collapse:collapse\">\n<tbody>\n<tr class=\"lexical-table-row\">\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p style=\"text-align:center\"><strong>Source<\/strong><\/p>\n<\/td>\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p style=\"text-align:center\"><strong>Environment Variables \/ Files<\/strong><\/p>\n<\/td>\n<\/tr>\n<tr class=\"lexical-table-row\">\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p>AWS<\/p>\n<\/td>\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p>AWS_REGION, AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN, profile files<\/p>\n<\/td>\n<\/tr>\n<tr class=\"lexical-table-row\">\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p>Azure \/ ARM<\/p>\n<\/td>\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p>ARM_TENANT_ID, ARM_CLIENT_ID, ARM_CLIENT_SECRET, ARM_OIDC_TOKEN_FILE_PATH, AZURE_VAULT_NAME<\/p>\n<\/td>\n<\/tr>\n<tr class=\"lexical-table-row\">\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p>Google Cloud<\/p>\n<\/td>\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p>GOOGLE_APPLICATION_CREDENTIALS, application default credential files<\/p>\n<\/td>\n<\/tr>\n<tr class=\"lexical-table-row\">\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p>HashiCorp Vault<\/p>\n<\/td>\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p>VAULT_TOKEN, VAULT_AUTH_TOKEN<\/p>\n<\/td>\n<\/tr>\n<tr class=\"lexical-table-row\">\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p>GitHub<\/p>\n<\/td>\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p>GITHUB_TOKEN, GITHUB_REPOSITORY, GITHUB_WORKFLOW_REF<\/p>\n<\/td>\n<\/tr>\n<tr class=\"lexical-table-row\">\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p>npm<\/p>\n<\/td>\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p>~\/.npmrc<\/p>\n<\/td>\n<\/tr>\n<tr class=\"lexical-table-row\">\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\"><template id=\"P:f\"><\/template><\/td>\n<p><template id=\"P:10\"><\/template><\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<p><strong>CI\/CD targeting.<\/strong> The payload checks <em>GITHUB_REPOSITORY<\/em> and <em>GITHUB_WORKFLOW_REF<\/em> to detect GitHub Actions environments. If the workflow reference matches an expected pattern, it triggers a separate, targeted exfiltration path before exiting. This allows quiet operation inside automated pipelines without leaving an unusual process running.<\/p>\n<p><strong>GitHub API exfiltration.<\/strong> Stolen credentials are formatted into structured reports and exfiltrated via the GitHub API. The payload contains a dedicated GitHub API client (<em>githubFetch<\/em>, <em>githubJson<\/em>) with Authorization header support. The command-and-control (C2) endpoint URL is stored encrypted under an additional layer (f4abccab2 decryptor) on top of the obfuscator.io string table, preventing static extraction.<\/p>\n<p><strong>Worm propagation.<\/strong> The payload contains a <em>bQ()<\/em> ROT-N function and <em>pQ()<\/em> payload generator identical in structure to the obfuscation used to encode the <em>index.js<\/em> files. This strongly suggests the payload is capable of generating new malicious package versions \u2014 using any npm credentials it steals to publish poisoned packages to additional scopes. <\/p>\n<p>All 31 packages contain both <em>_b <\/em>and <em>_p blobs<\/em> \u2014 they are not specific to chrome. Decrypting _b across multiple packages confirms it carries identical bun downloader code in every case; only the AES-GCM key, IV, and authentication tag differ, making the binary blob unique while the decrypted function is the same. The <em>_p<\/em> payloads are all unique-keyed and have not been decrypted for the other 30 packages.<\/p>\n<p>A structural split is visible from file sizes alone: four packages (<em>chrome<\/em>, <em>frontend-components<\/em>, f<em>rontend-components-advisor-components<\/em>, sources-client) produce <em>index.js<\/em> files of ~4.05 MB, while the remaining 27 produce files of ~4.29 MB \u2014 approximately 238 KB more ciphertext in <em>_p<\/em>. <\/p>\n<h3><strong>Detection: Behavioral indicators<\/strong><\/h3>\n<p>ReversingLabs Spectra Assure&#8217;s behavior analysis detects the injection through a cluster of indicators that are uniformly absent in the referential versions and uniformly present in the malicious ones:<\/p>\n<div class=\"lexical-table-container\">\n<table class=\"lexical-table\" style=\"border-collapse:collapse\">\n<tbody>\n<tr class=\"lexical-table-row\">\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p style=\"text-align:center\"><strong>Indicator<\/strong><\/p>\n<\/td>\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p style=\"text-align:center\"><strong>Description<\/strong><\/p>\n<\/td>\n<\/tr>\n<tr class=\"lexical-table-row\">\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p>BH13852<\/p>\n<\/td>\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p>Executes files during installation or upon launch<\/p>\n<\/td>\n<\/tr>\n<tr class=\"lexical-table-row\">\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p>BH15358<\/p>\n<\/td>\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p>Contains byte sequence decodable to printable string<\/p>\n<\/td>\n<\/tr>\n<tr class=\"lexical-table-row\">\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p>BH13525<\/p>\n<\/td>\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p>Evaluates code dynamically<\/p>\n<\/td>\n<\/tr>\n<tr class=\"lexical-table-row\">\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p>BH15183<\/p>\n<\/td>\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p>Converts binary data to string (obfuscation)<\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<p>Two additional indicators appear only in the chrome package payload:<\/p>\n<div class=\"lexical-table-container\">\n<table class=\"lexical-table\" style=\"border-collapse:collapse\">\n<tbody>\n<tr class=\"lexical-table-row\">\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p style=\"text-align:center\"><strong>Indicator<\/strong><\/p>\n<\/td>\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p style=\"text-align:center\"><strong>Description<\/strong><\/p>\n<\/td>\n<\/tr>\n<tr class=\"lexical-table-row\">\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p>BH16168<\/p>\n<\/td>\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p>Connects through HTTP<\/p>\n<\/td>\n<\/tr>\n<tr class=\"lexical-table-row\">\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p>BH13831<\/p>\n<\/td>\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p>Sets a JavaScript interval (recurring execution)<\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<p>The presence of HTTP connectivity and a repeating timer in the chrome payload indicates a more capable stage \u2014 one that establishes periodic callbacks, consistent with a persistent info-stealer or C2 beacon executing from the developer&#8217;s environment. The chrome package, used in the Red Hat Hybrid Cloud Console shell, runs in browser-facing build environments with access to Red Hat infrastructure credentials.<\/p>\n<h3><strong>Clean versions already published<\/strong><\/h3>\n<p>By the time of analysis, legitimate maintainers had already pushed clean follow-up versions for all 31 packages (N+1 patch versions). The malicious versions have since been removed from npm. Any project that pinned to these exact versions or ran npm install in the window between publish and removal is affected.<\/p>\n<p><strong>Recommendations<\/strong><\/p>\n<ul class=\"list-bullet\">\n<li class=\"\" value=\"1\"><strong>If you ran npm install on June 1, 2026 between ~10:54 and ~10:56 UTC<\/strong> and any of these packages are in your dependency tree \u2014 direct or transitive \u2014 treat the build environment as compromised. Rotate all credentials, tokens, SSH keys, and secrets accessible from that environment.<\/li>\n<li class=\"\" value=\"2\"><strong>Audit your lock files.<\/strong> Check package-lock.json or yarn.lock for exact version pins matching the malicious list above.<\/li>\n<li class=\"\" value=\"3\"><strong>Block the malicious hashes<\/strong> in Artifactory, Nexus, or any other artifact proxy. See the indicators of compromise (IoC) table below.<\/li>\n<li class=\"\" value=\"4\"><strong>Check transitive dependencies.<\/strong> Several of these packages are widely used as indirect dependencies; the total exposure is likely larger than direct installs suggest.<\/li>\n<li class=\"\" value=\"5\"><strong>Monitor for anomalous outbound connections<\/strong> from build agents, particularly HTTP traffic initiated by Node.js processes during npm install.<\/li>\n<\/ul>\n<h2 class=\"anchored-heading-block_anchoredHeading__E5Gpt\" data-alignment=\"left\" id=\"ioc\">Indicators of Compromise (IoCs)<\/h2>\n<p>All 31 malicious <em>index.js<\/em> hashes are unique (individually crafted payloads):<\/p>\n<div class=\"lexical-table-container\">\n<table class=\"lexical-table\" style=\"border-collapse:collapse\">\n<tbody>\n<tr class=\"lexical-table-row\">\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p style=\"text-align:center\"><strong>Package<\/strong><\/p>\n<\/td>\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p style=\"text-align:center\"><strong>Version<\/strong><\/p>\n<\/td>\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p style=\"text-align:center\"><em><strong>index.js<\/strong><\/em><strong> SHA-256<\/strong><\/p>\n<\/td>\n<\/tr>\n<tr class=\"lexical-table-row\">\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p>chrome<\/p>\n<\/td>\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p>2.3.1<\/p>\n<\/td>\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p>21b6409a7b84446310daca5409ad6112ac60a1e4bef97736e53fff5f63bfdef4<\/p>\n<\/td>\n<\/tr>\n<tr class=\"lexical-table-row\">\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p>compliance-client<\/p>\n<\/td>\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p>4.0.3<\/p>\n<\/td>\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p>5c6cb758a3447bc7e0de34406919a933f9351e90ef04ec43f3bbb401e7004e1b<\/p>\n<\/td>\n<\/tr>\n<tr class=\"lexical-table-row\">\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p>config-manager-client<\/p>\n<\/td>\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p>5.0.4<\/p>\n<\/td>\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p>5dabf08e2655c012e478074a2cea2b0d34e286c27265a26f3846fc45e5584501<\/p>\n<\/td>\n<\/tr>\n<tr class=\"lexical-table-row\">\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p>entitlements-client<\/p>\n<\/td>\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p>4.0.11<\/p>\n<\/td>\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\">\n<p>2a446171b4b981d98b5af6c5606bd63b1570040334210b6ab0a10901b2606fe5<\/p>\n<\/td>\n<\/tr>\n<tr class=\"lexical-table-row\">\n<td class=\"lexical-table-cell lexical-table-cell-header-0\" style=\"border:1px solid #ccc;padding:8px\"><template id=\"P:11\"><\/template><\/td>\n<p><template id=\"P:12\"><\/template><template id=\"P:13\"><\/template><\/tr>\n<p><template id=\"P:14\"><\/template><template id=\"P:15\"><\/template><template id=\"P:16\"><\/template><template id=\"P:17\"><\/template><template id=\"P:18\"><\/template><template id=\"P:19\"><\/template><template id=\"P:1a\"><\/template><template id=\"P:1b\"><\/template><template id=\"P:1c\"><\/template><template id=\"P:1d\"><\/template><template id=\"P:1e\"><\/template><template id=\"P:1f\"><\/template><template id=\"P:20\"><\/template><template id=\"P:21\"><\/template><template id=\"P:22\"><\/template><template id=\"P:23\"><\/template><template id=\"P:24\"><\/template><template id=\"P:25\"><\/template><template id=\"P:26\"><\/template><template id=\"P:27\"><\/template><template id=\"P:28\"><\/template><template id=\"P:29\"><\/template><template id=\"P:2a\"><\/template><template id=\"P:2b\"><\/template><template id=\"P:2c\"><\/template><template id=\"P:2d\"><\/template><\/tbody>\n<\/table>\n<\/div>\n<h2 id=\"watch-this-space\">Watch this space<\/h2>\n<p>This attack illustrates the leverage a single scope-level credential compromise can provide: 31 packages, 9.8 million downloads, and a payload capable of self-propagation \u2014 all published in under two minutes. The individually crafted payloads across every package, the per-package AES-GCM key material, and the ROT-N variance are deliberate choices to defeat both hash-based detection and bulk analysis. That each package requires independent decryption to fully characterize is itself a structural defense the attacker built in.<\/p>\n<p>ReversingLabs is continuing to monitor the <em>@redhat-cloud-services<\/em> scope and will update this post if additional affected versions or payload variants are identified. Full IoC coverage for all 31 packages is available in Spectra Assure. Teams using Spectra Assure to monitor open-source dependencies will have detected this attack via the BH13852 and BH13525 behavior indicators present across all affected versions.<\/p>\n<h2 class=\"anchored-heading-block_anchoredHeading__E5Gpt\" data-alignment=\"left\" id=\"updates\">Updates and analysis<\/h2>\n<p>Since this post was first published, there are important updates, including:<\/p>\n<p><strong>The attack has been named and attributed.<\/strong> The broader security community (Snyk, Wiz, Mend, Phoenix) dubbed it &#8220;Miasma: The Spreading Blight&#8221; and identified it as a variant of the Mini Shai-Hulud worm framework, attributed to threat actor group TeamPCP. The post could reference this name since it&#8217;s now the recognized identifier for this campaign.<\/p>\n<p><strong>Root cause is more specific than scope-level credential theft.<\/strong> RL&#8217;s initial post concluded it was an npm scope-level account compromise. Post-publication research (confirmed by Red Hat&#8217;s own bulletin RHSB-2026-006) shows the initial vector was a Red Hat employee&#8217;s GitHub account compromised via a malicious VS Code extension on May 29. The attacker pushed malicious orphan commits to RedHatInsights repos, then used GitHub Actions OIDC to publish the packages \u2014 not stolen npm credentials directly.<\/p>\n<p><strong>Valid SLSA provenance.<\/strong> Because the publish happened inside a legitimate repo&#8217;s Actions context, the malicious packages shipped with valid SLSA provenance attestations \u2014 a significant angle the post doesn&#8217;t address. The packages &#8220;passed&#8221; provenance verification even though the workflow was unauthorized. This is a notable supply chain security lesson worth calling out explicitly.<\/p>\n<p><strong>Second wave \/ package count discrepancy.<\/strong> Snyk&#8217;s analysis documents a second wave of malicious commits later on June 1, pushing the total to 32 packages (not 31). Worth noting if the post gets updated.<\/p>\n<p><strong>Broader TeamPCP campaign context.<\/strong> This wasn&#8217;t an isolated incident. TeamPCP had been running CI\/CD supply chain attacks since at least April 2026, hitting Bitwarden, SAP, PyTorch Lightning, Microsoft, and 160+ other packages. The post could add a paragraph placing this attack in that larger campaign.<\/p>\n<p><strong>Red Hat officially closed the incident.<\/strong> Red Hat issued security bulletin RHSB-2026-006 and formally closed on June 17, 2026, confirming no Red Hat products or enterprise software shipped with a compromised version. This is worth an update note at the top\/bottom of the post.<\/p>\n<p><strong>New payload capability: cloud identity enumeration.<\/strong> The Miasma variant added GCP and Azure identity collectors that go beyond stealing static credentials \u2014 they enumerate every identity the infected host can assume, mapping the cloud control plane. The RL post lists AWS, Azure, and GCP credential targets but doesn&#8217;t highlight this new enumeration behavior as a distinct escalation from prior variants.<\/p>\n<p><small class=\"small-text-block_smallText__HEOYA\" data-component=\"small-text-block\"><\/p>\n<div class=\"rich-text_richText__UyrDZ\" data-component=\"rich-text\" data-reader-view=\"false\">\n<div class=\"payload-richtext\">\n<p>This post was researched by RL AI agents and written by generative AI.<\/p>\n<\/div>\n<\/div>\n<p><\/small><\/p>\n<\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>RL researchers have uncovered a large-scale, coordinated supply chain attack targeting the@redhat-cloud-servicesnpm scope. On June 1, an attacker published malicious versions of 31 packages (update) in a 72-second window, injecting obfuscated preinstall malware into every one.The affected packages collectively represent approximately 9.8 million total downloads and cover the full breadth of Red Hat&#8217;s Hybrid Cloud Console JavaScript ecosystem \u2014 UI components, API clients, build tooling, configura<\/p>\n","protected":false},"author":4,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"colormag_page_container_layout":"default_layout","colormag_page_sidebar_layout":"default_layout","footnotes":""},"categories":[32775],"tags":[],"class_list":["post-26204","post","type-post","status-publish","format-standard","hentry","category-reversinglabs"],"_links":{"self":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/26204","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/comments?post=26204"}],"version-history":[{"count":0,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/26204\/revisions"}],"wp:attachment":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/media?parent=26204"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/categories?post=26204"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/tags?post=26204"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}