Supply chain attacks on CI/CD pipelines expose developer credentials

supply chain attack npm packages GitHub Actions credential theft CI/CD pipeline security

A large‑scale supply‑chain compromise targeted the @redhat-cloud-services npm namespace on June 1, 2026, injecting malicious code into more than 30 packages. The back‑doored modules deploy a credential‑stealing payload that harvests cloud tokens, GitHub credentials, Kubernetes secrets and other keys from developers' machines and CI/CD runners. The malware also disguises exfiltration traffic to a look‑alike Anthropic API domain and can execute destructive commands if stolen GitHub tokens are revoked.

A separate, earlier incident in March 2025 affected over 23,000 repositories when a popular GitHub Action (tj‑actions/changed‑files) was silently republished with malicious code. The altered Action logged AWS keys, GitHub PATs, RSA private keys and npm tokens from pipeline environments, exposing them to anyone with log access. The attack was assigned CVE‑2025‑30066 and highlighted the risk of version‑tagged actions versus pinned commit SHAs. Both events underscore the vulnerability of CI/CD pipelines to supply‑chain attacks and the need for stricter pipeline hardening and secret‑management practices.

Sources

Malicious code found in Red Hat's npm packages [www.techzine.eu]

2 months ago

Kwaadaardige code aangetroffen in npm-packages van Red Hat [www.techzine.nl]

2 months ago

Multiple Red Hat Cloud Services npm Packages Compromised to Deploy Credential-Stealing Malware [cybersecuritynews.com]

2 months ago

Des paquets npm Red Hat compromis ont diffusé un malware ciblant les identifiants des développeurs [www.clubic.com]

2 months ago

How 23,000 Repos Got Their Secrets Stolen Through Their Own CI/CD Pipeline [dev.to]

2 months ago