Multiple redhat-cloud-services npm packages compromised (StepSecurity Blog)

StepSecurity is reporting that a number of npm packages in the @redhat-cloud-services scope include malware that runs automatically on every npm install: The payload is a multi-stage credential harvester that sweeps GitHub Actions secrets along with AWS, GCP, Azure, Kubernetes, HashiCorp Vault, npm, and CircleCI tokens, and it is purpose-built to evade detection, including an explicit attempt to bypass StepSecurity Harden-Runner. StepSecurity analyzed @redhat-cloud-services/[email protected] in full. Its index.js, executed at install time, is 4.2 MB, a file that should weigh…

Quelle: Originalartikel öffnen