Supply Chain Attack Hit Red Hat’s Hybrid Cloud Console JavaScript ecosystem

On June 1, 2026, a highly automated, large-scale supply chain attack targeted Red Hat’s Hybrid Cloud Console JavaScript ecosystem. Over a tight 72-second window (10:54:09 to 10:55:21 UTC), an attacker pushed 32 malicious packages under the @redhat-cloud-services npm scope. The attack injected identical multi-layered obfuscated dropper malware designed to harvest cloud credentials and propagate further via worm-like mechanics. Because the affected components span two distinct GitHub repositories, this incident has been confirmed as a scope-level account credential compromise.

Severity: High

Attack Timeline (Utc, June 1 2026)

• 10:54:09 :- First malicious packages published tsc-transform-imports, types
• 10:54:09 – 10:55:04 :- Remaining 30 packages published in rapid batch via automated script
• 10:55:21 :- Last malicious package published rbac-client (942k downloads)
• Post ~10:56 :- Legitimate maintainers publish clean N+1 patch versions; malicious versions removed from npm registry

Attack Details

1. Initial access: Scope-level npm credential theft
   Attacker obtained publish credentials for the entire @redhat-cloud-services namespace not tied to any individual GitHub repository. Spans two source repos, confirming credential theft at npm scope level.
2. Execution & persistence: Preinstall hook injection via package.json
   Two files modified per package: package.json (adds “preinstall”: “node index.js”) and index.js (fully replaced with obfuscated dropper). No other files touched surgical, automated tooling.
3. Defense evasion 4 obfuscation layers
   a. ROT-N Caesar cipher: Unique rotation value (N) per package ~4 MB of char codes, visually distinct blobs, same decode engine
   b. AES-128-GCM authenticated encryption: Two encrypted blobs per package; unique keys, IVs, auth tags. GCM prevents tampering-based extraction
   c. Obfuscator.io toolchain (634 KB payload): String array encoding, control flow flattening, identifier mangling
   d. Unique SHA-256 per package: Individually tailored payloads defeat hash-based deduplication; each package must be analyzed independently
4. Bun runtime download (evasion via legitimate binary): Downloads bun v1.3.13 from github.com/oven-sh/bun/releases a legitimate binary from a legitimate source. Avoids suspicious network traffic. If bun is already present, download step skipped.

Payload Capabilities

1. Credential harvesting
   • AWS: Access key, secret, session token, profiles
   • Azure / ARM: Tenant ID, client ID/secret, OIDC token
   • Google Cloud: Application default credentials
   • HashiCorp Vault: VAULT_TOKEN, VAULT_AUTH_TOKEN
   • GitHub: GITHUB_TOKEN, workflow refs
   • npm / SSH: ~/.npmrc, ~/.ssh/
2. Exfiltration method: GitHub API client embedded in payload (githubFetch). C2 URL stored under additional encryption layer on top of obfuscator.io string table prevents static extraction.
3. CI/CD targeting: Checks GITHUB_REPOSITORY and GITHUB_WORKFLOW_REF triggers targeted exfiltration path in GitHub Actions environments and exits quietly.
4. Worm propagation: Contains ROT-N encoder + payload generator identical to the dropper’s structure. If npm credentials are stolen, can publish poisoned versions to additional scopes.

Recommendations

1. If a npm install or automated build script executed on June 1, 2026, between 10:54 UTC and 10:56 UTC, assume full environment compromise. Revoke and rotate all cloud provider keys (AWS, GCP, Azure), HashiCorp tokens, GitHub pipeline secrets, SSH configurations, and registry tokens instantly.
2. Audit all internal repositories for package-lock.json, yarn.lock, or pnpm-lock.yaml files. Force-upgrade any pinned dependencies to the legitimate maintainers’ clean $N+1$ patch versions and ensure the malicious versions are completely purged from dependency trees.
3. Configure your repository managers (e.g., JFrog Artifactory, Sonatype Nexus, AWS CodeArtifact) to explicitly block and drop packages matching the 32 unique index.js SHA-256 hashes identified in the incident.
4. Monitor for anomalous outbound connections from build agents, particularly HTTP traffic initiated by Node.js processes during npm install.
5. Block the IOCs at their respective controls
   https://www.virustotal.com/gui/collection/b175ce19f0bcfd48181e1141cec4ae8ee60346d96cb98b55ef12558fa6ed6100/iocs

IOCs

Source:

• https://www.reversinglabs.com/blog/red-hat-cloud-service-npm-packages-backdoored-in-72-seconds

Enjoyed reading this Threat Intelligence Advisory? Stay updated with our latest exclusive content by following us on Twitter and LinkedIn

No related posts found.