Post

🚨 Supply Chain Attack Alert! 🚨 31 @redhat-cloud-services hashtag#npm packages backdoored in 72 seconds! ReversingLabs has confirmed a large-scale, coordinated supply chain attack targeting the "@redhat-cloud-services" npm scope.

On June 1, an attacker published malicious versions of 31 packages in a 72-second automated scripted push — affecting approximately 9.8 million total downloads across Red Hat's Hybrid Cloud Console JavaScript ecosystem.

WHAT HAPPENED Every malicious version follows the same two-file modification pattern: "package.json" gained a "preinstall" hook pointing to "index.js," and "index.js" — the package's own entry point — was fully replaced with an obfuscated dropper. No other files were touched.

The surgical precision confirms automated tooling. The obfuscation uses two stacked layers: a ROT-N caesar cipher decodes a first-stage JavaScript string, which then uses Node.js's built-in "crypto" module to perform AES-128-GCM decryption of the final payload.

The attacker generated 31 individually tailored payloads — each with its own rotation value, AES key, and IV — giving every "index.js" a unique SHA-256 hash.

SCOPE OF COMPROMISE The 31 packages span two separate GitHub source repositories ("RedHatInsights/frontend-components" and "RedHatInsights/javascript-clients"), confirming this was a scope-level npm credential compromise — not a per-repository breach.

Affected packages include widely used components: "frontend-components" (1.35M downloads), "frontend-components-utilities" (1.49M), "types" (1.28M), "rbac-client" (942K), "frontend-components-config-utilities" (874K), and "frontend-components-config" (788K), among others.

Clean N+1 versions have been published by legitimate maintainers for all 31 packages. The malicious versions have since been removed from npm.

Rotate all credentials, tokens, SSH keys, and secrets accessible from that environment. Audit your lock files for the exact malicious version pins and block the SHA-256 hashes in your artifact proxy.