Red Hat Cloud Services pipeline compromised via malicious npm package
On June 1, 2026, an attacker abused npm’s trusted publishing via a malicious GitHub Actions workflow to release compromised versions of Red Hat Cloud Services npm packages. The injected preinstall hook deploys a Bun‑based worm that harvests cloud, repository and password manager credentials and exfiltrates them. The incident highlights supply‑chain risks in CI OIDC token usage.