Home / Technology / Red Hat NPM Accounts Hacked, Malicious Worm Unleashed
Red Hat NPM Accounts Hacked, Malicious Worm Unleashed
2 Jun
Summary
- Red Hat's npm packages compromised, distributing a credential-stealing worm.
- The malware, named Shai-Hulud, spreads by republishing backdoored packages.
- Systems installing affected packages are considered potentially compromised.
A severe supply-chain attack has compromised Red Hat's official npm accounts, allowing threat actors to distribute a malicious worm. The malware, dubbed Shai-Hulud, was active as of the reporting date, having infiltrated the trusted @redhat-cloud-services namespace.
Researchers detected the attack starting on Monday. The worm operates by executing an obfuscated payload during the npm install phase. This payload is designed to pilfer sensitive credentials, including GitHub action secrets, npm tokens, and cloud service credentials. It then propagates by republishing backdoored packages through third-party accounts accessible from infected devices.
Organizations are advised to consider any system that installed affected @redhat-cloud-services package versions as potentially compromised. The malware specifically targets CI/CD systems, with Red Hat's GitHub Actions OIDC compromise indicating a successful infiltration of its automated release pipeline. The incident highlights the escalating threat of supply-chain attacks, with similar malware previously promoted for its supply-chain attack capabilities.
