Affected Systems
Red Hat Cloud Services npm packages (@redhat-cloud-services scope). Affects developers and CI/CD pipelines using these packages. Scope includes any environment where compromised packages were installed.
Exploitation Status
Active exploitation confirmed. Attackers deployed credential-stealing malware and self-propagating worm via compromised npm packages. Install-time execution triggers automatically during npm install.
Business Impact
Critical risk to development environments and CI/CD infrastructure. Compromised credentials, secrets, and environment variables may grant attackers access to production systems, source code repositories, cloud accounts, and internal networks. Self-propagating nature increases blast radius. Organizations using affected packages face immediate credential compromise and potential lateral movement.
Urgency
🔴 Immediate
Recommended Actions
- Immediately audit all projects for @redhat-cloud-services npm dependencies and remove compromised packages
- Rotate all credentials, API keys, tokens, and secrets on developer machines and CI/CD systems that installed affected packages
- Review npm audit logs and package-lock.json files to identify installation timeframes and scope of exposure
- Monitor network traffic for unusual outbound connections from developer workstations and build servers to detect exfiltration
- Implement package integrity verification and consider using private npm registries with vetted packages only