Cuộc tấn công chuỗi cung ứng npm đang nhắm vào các gói dịch vụ đám mây Red Hat, hơn 300 kho lưu trữ GitHub bị ảnh hưởng

The Huoxing Finance report states that on June 2, SlowMist issued a security alert detecting an active npm supply chain attack targeting packages related to @redhat-cloud-services. To date, over 31 packages have been confirmed as compromised, with approximately 116,000 weekly downloads, and stolen credentials have been found in over 300 GitHub repositories. The attack technique closely resembles the previous "Shai-Hulud" npm attack, including credential theft, creation of malicious repositories, and automated secret exfiltration. New suspicious repositories continue to emerge, indicating the attack is still ongoing and developers remain continuously infected. Potential impacts include theft of GitHub/npm tokens, exposure of AWS/GCP/Azure cloud credentials, collection of SSH keys and Kubernetes secrets, leakage of local environment and wallet data, creation and persistence of malicious repositories, and even destructive actions triggered after token revocation. It is recommended to immediately remove or downgrade the affected @redhat-cloud-services package versions, conduct a comprehensive audit of CI/CD workflows and dependency installations, rotate all keys related to GitHub, npm, cloud services, SSH, and wallets, retain logs, and rebuild compromised developer machines or Runners from clean images, while maintaining heightened vigilance.