Researchers find packages in the @redhat-cloud-services npm namespace shipped malware that harvests credentials for GitHub Actions, AWS, GCP, Azure, and others
Several packages in the @redhat-cloud-services npm scope were found to carry malicious payloads that fire via a preinstall hook on every npm install.
Context & Ripple Effects
This report follows a cluster of npm supply-chain incidents: recent coverage described the Shai-Hulud campaign publishing hundreds of malicious package versions, including impacts in the @antv ecosystem, while an earlier incident involved malware injected after a maintainer-account phishing compromise.
The immediate significance is the target set. A malicious install-time hook aimed at GitHub Actions and major cloud credentials can turn a developer dependency workflow into a route toward deployment and infrastructure environments.
First-order effects
- Teams that installed affected @redhat-cloud-services packages must treat credentials available during installation—including CI/CD and cloud credentials—as potentially exposed and rotate or revoke them as appropriate.
- The affected npm scope and its maintainers face an immediate package-integrity response: identifying malicious versions, removing or superseding them, and restoring trust in downstream installs.
Second-order effects
- Organizations using npm in build pipelines will face pressure to reduce credential exposure during dependency installation, since compromised packages can target the same credentials used to automate releases and cloud changes.
- Package consumers and security tooling vendors will place greater emphasis on detecting lifecycle-script behavior and tracing transitive dependencies, rather than treating a trusted namespace or maintainer identity as sufficient assurance.
Third-order effects
- If repeated campaigns continue to pair package compromise with cloud and CI credential harvesting, software-package registries become a more consequential control point for cloud-security posture, not merely application-dependency hygiene.
- The pattern favors stronger provenance, publisher-account protections, and more constrained build credentials across the ecosystem; the coverage does not establish which controls registries or cloud providers will adopt.
The trend: Npm supply-chain attacks are increasingly using compromised packages as an entry point to capture the credentials that connect developer workflows to cloud infrastructure and automated deployment systems.