Npm

Several packages in the @redhat-cloud-services npm scope were found to carry malicious payloads that fire via a preinstall hook on every npm install, targeting GitHub Actions secrets, AWS, GCP, and other credentials.

Malicious npm releases have been detected across the @redhat-cloud-services/ scope, Warehouses are impacted. According to StepSecurity, multiple RedHat Cloud Services npm packages have been compromised.

Npm-scan is a modern supply chain security tool for the npm ecosystem, offering static and behavioral analysis to catch threats that other tools like npm audit, Snyk, and Socket miss.