Researchers find packages in the @redhat-cloud-services npm namespace shipped malware that harvests credentials for GitHub Actions, AWS, GCP, Azure, and others
Several packages in the @redhat-cloud-services npm scope were found to carry malicious payloads that fire via a preinstall hook on every npm install.
Context & Ripple Effects
This incident follows a run of npm supply-chain compromises, including the Shai-Hulud campaign affecting hundreds of malicious package versions and a separate maintainer-account compromise that spread malware through widely used packages. The repeated pattern is that a trusted package distribution channel can become the delivery mechanism.
The targeted credentials span GitHub Actions and major cloud platforms, making the exposure relevant beyond a single development dependency: stolen automation or cloud credentials can give attackers access to build and deployment environments.
First-order effects
- Teams that installed affected @redhat-cloud-services packages may need to treat credentials available during installation—including CI and cloud credentials—as potentially exposed and rotate them.
- The affected npm namespace and its maintainers face an immediate trust and remediation burden: remove malicious versions, identify affected consumers, and secure publishing access.
Second-order effects
- Organizations using npm in CI are likely to tighten installation practices, reducing which secrets are available to dependency-install jobs and increasing scrutiny of lifecycle hooks such as preinstall.
- Cloud and source-control platforms are indirectly affected because compromised developer-package ecosystems can turn their credentials into downstream targets, increasing demand for scoped, short-lived automation credentials and stronger secret monitoring.
Third-order effects
- If these campaigns persist, package provenance and publisher-account security will become more central controls in software delivery, rather than optional checks applied after dependencies are selected.
- The pattern reinforces a shift from protecting individual applications to securing the developer supply chain: registries, maintainers, CI systems, and cloud identity controls increasingly form one attack surface.
The trend: This is another data point in the convergence of open-source package compromise and credential theft aimed at the CI-to-cloud software delivery path.