Red Hat NPM Packages Backdoored in Supply Chain Attack: What Was Reportedly Exposed & What To Do

Red Hat was the target of a supply chain attack in which malicious versions of its NPM packages were published after compromise of an employee GitHub account and associated CI/CD pipeline. The incident was reported on June 02, 2026. Attackers published 96 malicious versions across 32 @redhat-cloud-services packages that had accumulated nearly 10 million downloads; more than 200 downstream repositories later showed signs that credentials had been harvested from systems that installed the packages. The number of individuals or organizations directly affected remains unknown. The packages contained a preinstall hook that deployed credential-stealing malware, and the exposed data types reported include GitHub secrets, npm tokens, cloud credentials, and SSH keys.

Inside the incident

The attack began with unauthorized access to a Red Hat employee’s GitHub account. From that foothold the attackers reached the company’s CI/CD pipeline and used it to release the tainted package versions. Once installed, the packages executed code that collected credentials from the developer environment. Public reporting has not disclosed the precise date or method of the initial account compromise, the duration of unauthorized access, or any internal detection timeline.

How a breach like this happens

Supply-chain compromises of this type commonly begin with the theft of developer credentials or session tokens that grant access to code repositories and build systems. Once inside, an attacker can modify build scripts or inject code into published artifacts without needing to breach the organization’s primary production networks. The altered packages then reach downstream users through ordinary dependency updates, allowing credential collection on any system that runs the installation process.

Who is Red Hat?

Red Hat develops and distributes enterprise open-source software, including Linux operating systems, container platforms, and cloud-management tools used by governments, financial institutions, and technology companies worldwide. Its packages and services are frequently incorporated into larger software supply chains, which means a compromise at this level can propagate to many other organizations that rely on Red Hat components for their own infrastructure.

What was likely exposed

The facts identify GitHub secrets, npm tokens, cloud credentials, and SSH keys as the data types collected by the malicious packages. No confirmed inventory of specific values or accounts has been released. Organizations of this kind routinely store authentication material for code repositories, cloud providers, and internal systems; the exact scope of what was taken in this case therefore remains unconfirmed beyond the categories already stated.

The real-world impact

Compromised credentials can be used to access private repositories, cloud resources, or internal networks, potentially enabling further unauthorized activity or data access. Downstream organizations that installed the affected packages may face the need to rotate keys, audit logs, and review any systems that executed the malicious install script. Because the number of affected individuals is not yet known, the full extent of follow-on risk cannot be quantified from currently available information.

If your data was in this claimed breach

Review any recent changes to accounts associated with GitHub, npm, or cloud providers and rotate the relevant credentials. Monitor authentication logs for unusual access from unfamiliar locations or devices. Individuals can run a free exposure scan of their email address against known breach data sets to check whether their information appears in public listings of this or other incidents.

AICompiled with AI assistance from public sources and published under our editorial standards.