Red Hat npm packages compromised to steal developer credentials
A supply-chain attack targeting Red Hat npm packages resulted in the distribution of a new variant of the Shai-Hulud credential-stealing malware, dubbed 'Miasma'. The attackers compromised a Red Hat employee's GitHub account to inject malicious code into over 30 packages used for internal development, potentially exposing developer credentials and sensitive information. Red Hat swiftly removed the compromised packages from the npm registry and is continuing its investigation.
The incident began with a compromise of a Red Hat employee's GitHub account, allowing attackers to push malicious commits directly into multiple repositories within the '@redhat-cloud-services' npm namespace. These commits introduced a GitHub Actions workflow and a script that leveraged npm's publishing mechanism to release backdoored versions of the packages. This workflow utilized OIDC permissions to authenticate with npm and publish the malicious code, which included a preinstall script that executed a heavily obfuscated JavaScript file. This file was designed to steal a wide range of sensitive information, including GitHub Actions secrets, cloud credentials, SSH keys, and tokens for various services like Kubernetes and PyPI. The attack has similarities to previous Shai-Hulud campaigns, with the Red Hat variant incorporating enhanced obfuscation and data theft capabilities. The incident highlights the risks associated with supply chain vulnerabilities and the potential for attackers to leverage compromised developer accounts to inject malicious code into widely used packages.