Multiple redhat-cloud-services npm Packages compromised

What it is

A supply-chain compromise of multiple @redhat-cloud-services npm packages, disclosed by StepSecurity on June 1, 2026. Malicious versions carry a multi-stage, install-time credential harvester and a self-propagating worm. The compromise reaches back into CI/CD: all affected packages were published via GitHub Actions OIDC from RedHatInsights/javascript-clients, meaning the upstream pipeline itself — not just individual package accounts — was compromised. Disclosure issues are filed against RedHatInsights/javascript-clients#492, frontend-components#2329, and platform-frontend-ai-toolkit#57.

How it works

Each malicious package declares "preinstall": "node index.js", so the payload runs the moment npm install processes it, before application code. The index.js is 4.2 MB (a library script should be a few KB) — a usable anomaly signal. The payload is buried under four obfuscation layers: (1) ROT-21 in a silent try{eval(...)}catch{}; (2) two AES-128-GCM blobs (_b Bun downloader, _p implant) with hardcoded keys/IVs; (3) obfuscator.io custom-base64 with a 2,219-entry string table rotated R=284 times; (4) a "B5" cipher (200,000-iteration PBKDF2 + Fisher-Yates).

At runtime the implant reads /proc/<pid>/mem of the Runner.Worker process, queries the Actions runtime API with ACTIONS_RUNTIME_TOKEN to find variables flagged isSecret: true, and extracts them from memory — bypassing log masking entirely. It sweeps GitHub Actions secrets plus AWS, GCP, Azure, Kubernetes, HashiCorp Vault, npm, and CircleCI tokens, and explicitly attempts to bypass StepSecurity Harden-Runner.

The worm uses stolen npm tokens and npm's bypass_2fa parameter to republish backdoored versions of other packages autonomously — even on 2FA-protected accounts — so each infected machine seeds the next wave with no attacker involvement.

flowchart TD
  A[npm install] --> B[preinstall: node index.js 4.2MB]
  B --> C[4 obfuscation layers]
  C --> D[read /proc/pid/mem + isSecret vars]
  D --> E[Exfiltrate CI/cloud/npm tokens]
  E --> F[bypass_2fa: republish backdoored packages]
  F --> A

Preconditions / Affected

Any pipeline or developer machine that installed an affected @redhat-cloud-services version. Runtime analysis was performed on @redhat-cloud-services/notifications-client@6.1.4. GitHub Actions runners are the primary secret-extraction target.

What to do

• If you or your pipelines installed any affected version, assume the CI/CD environment or developer machine is already compromised and rotate all exposed credentials immediately (cloud, npm, Vault, CircleCI, Actions secrets).
• Treat a 4.2 MB index.js / oversized preinstall script in these packages as an indicator.

Caveats

C2 domains are not yet confirmed — decryption using the recovered B5 parameters (password ba2c6ddb...a709, salt 5b26508d...487e) was in progress at publication, and the post will be updated. The full affected-package list and pipeline scope were still being confirmed with maintainers.