Post

On June 1, an attacker published malicious versions of 31 packages in a 72-second automated scripted push — affecting approximately 9.8 million total downloads across Red Hat's Hybrid Cloud Console JavaScript ecosystem.

WHAT HAPPENED Every malicious version follows the same two-file modification pattern: "package.json" gained a "preinstall" hook pointing to "index.js," and "index.js" — the package's own entry point — was fully replaced with an obfuscated dropper. No other files were touched.

The surgical precision confirms automated tooling. The obfuscation uses two stacked layers: a ROT-N caesar cipher decodes a first-stage JavaScript string, which then uses Node.js's built-in "crypto" module to perform AES-128-GCM decryption of the final payload.