Trending Now - Malware Discovered in Red Hat's Official NPM Packages

WHO:

Ars Technica - Red Hat is the organization involved in the incident.

Techmeme - Researchers from Step Security Blog are involved in the discovery of the malware.

WHAT:

Ars Technica - Dozens of Red Hat packages have been backdoored through its official NPM channel.

Techmeme - Several packages in the @redhat-cloud-services npm namespace were found to carry malware targeting credentials for GitHub Actions, AWS, GCP, and others.

Techmeme - The malicious payloads activate via a preinstall hook on every npm install.

WHERE:

Techmeme - The affected packages are located in the @redhat-cloud-services npm namespace.

WHY:

Techmeme - The malware targets credentials for various services, indicating a motive to compromise user accounts and access.

HOW:

Techmeme - The malware is delivered through a preinstall hook that executes during the npm install process.

(UPDATED June 1, 2026 23:28 UTC)

Red Hat is facing a significant security incident, as dozens of its packages have been backdoored through its official NPM channel, with researchers from Step Security Blog uncovering the malware. Several packages in the @redhat-cloud-services npm namespace have been found to carry malicious payloads that target credentials for services like GitHub Actions, AWS, and GCP, activating through a preinstall hook during the npm install process. This troubling development suggests a motive to compromise user accounts and gain unauthorized access to sensitive information.