Dozens of Red Hat packages backdoored through its official NPM channel
Key points
- Official Red Hat NPM accounts have been compromised and used to push a malicious worm that spreads from machine to machine, where it pilfers sensitive credentials in hopes of stealing yet more confidential data, researchers said.
- The supply-chain attack began Monday and remained active at the time this post went live, according to researchers at security firm Aikido.
- It’s the result of the threat actor responsible for the hack taking control of @redhat-cloud-services, a legitimate channel in the npm repository that’s reserved for official Red Hat packages.
- As such, the channel is widely trusted by developers who rely on Red Hat cloud services.
- The vicious cycle of today’s supply-chain attacks It’s unclear precisely how the threat actor took control of the namespace, but it almost certainly involved the compromise of credentials required to access it, possibly through a previous supply-chain attack.
Quick Summary
Official Red Hat NPM accounts have been compromised and used to push a malicious worm that spreads from machine to machine, where it pilfers sensitive
Why It Matters
This development is important because it may impact public opinion, policy decisions, and future developments related to Dozens of Red Hat packages backdoored through its official N.
Key Takeaways
- Official Red Hat NPM accounts have been compromised and used to push a malicious worm that spreads from machine to machine, where it pilfers sensitive credentials in hopes of stealing yet more confidential data, researchers said.
- The supply-chain attack began Monday and remained active at the time this post went live, according to researchers at security firm Aikido.
- It’s the result of the threat actor responsible for the hack taking control of @redhat-cloud-services, a legitimate channel in the npm repository that’s reserved for official Red Hat packages.
- As such, the channel is widely trusted by developers who rely on Red Hat cloud services.
- The vicious cycle of today’s supply-chain attacks It’s unclear precisely how the threat actor took control of the namespace, but it almost certainly involved the compromise of credentials required to access it, possibly through a previous supply-chain attack.
📌 Source: Dan Goodin
The BriefWire