{"id":181856,"date":"2026-06-02T08:48:05","date_gmt":"2026-06-02T06:48:05","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/atakuyushhie-vstroili-vredonosnoe-po-v-32-npm-paketa-red-hat"},"modified":"2026-06-02T08:48:05","modified_gmt":"2026-06-02T06:48:05","slug":"atakuyushhie-vstroili-vredonosnoe-po-v-32-npm-paketa-red-hat","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/atakuyushhie-vstroili-vredonosnoe-po-v-32-npm-paketa-red-hat","title":{"rendered":"Attackers Embedded Malware in 32 Red Hat NPM Packages","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
As a result of the compromise of the GitHub Actions release process in repositories owned by Red Hat, attackers were able to publish 64 malicious versions in the NPM directory, covering 32 NPM packages for the Red Hat Cloud Services platform. Two malicious versions were released for each affected NPM package, integrating code to activate a new variant of the mini-shai-hulud worm, which searches for tokens and credentials in the current environment. <\/p>\n
The worm was located in the index.js file and was activated via a preinstall handler triggered during the installation of the affected package. After activation, the worm searched the system for tokens for NPM (~\/.npmrc), PyPI, CircleCI, AWS, GCP, Docker, Azure, HashiCorp, and Kubernetes K8s, as well as private SSH keys. The discovered data was sent to the attackers. If a token for connecting to the NPM directory was found, the worm automatically published new malicious releases for the packages being developed in the current environment, affecting the dependency tree. <\/p>\n
Access to GitHub Actions was obtained due to the compromise of an employee's account at Red Hat, which allowed attackers to directly send commits to the javascript-clients, frontend-components, and platform-frontend-ai-toolkit repositories without going through the review stage. Through commits in the continuous integration system, a ci.yaml file was injected, which, when the build job was triggered, executed the _index.js script using the bun platform. The script utilized the 'id-token: write' permission to request an OIDC (OpenID Connect) token from GitHub, which was then used for authentication in NPM through the 'trusted publishing' mechanism.<\/p>\n