Multiple redhat-cloud-services npm Packages compromised

Multiple npm packages under the @redhat-cloud-services scope were found to contain malicious code designed to execute during package installation. The compromise affected several packages across the RedHat Cloud Services frontend ecosystem.\n\nThe malicious payload activates via a preinstall hook that runs automatically when the package is installed via npm. The attack implements a sophisticated multi-stage credential harvester targeting a wide range of valuable secrets and tokens.\n\nThe harvester specifically targets credentials from GitHub Actions secrets, AWS, GCP, Azure, Kubernetes, HashiCorp Vault, npm tokens, and CircleCI tokens. This broad targeting indicates the attacker sought to compromise environments and systems used by downstream organizations.\n\nAny project that installed affected versions of these packages during the compromise window would have had credentials and secrets exposed to the attacker.