This threat involves malicious code injected into the @redhat-cloud-services/hcc-pf-mcp npm package (versions 0.6.1, 0.6.2, 0.6.4) as part of a supply chain worm campaign leveraging compromised GitHub Actions OIDC trusted publisher credentials. The injected preinstall hook delivers a three-layer obfuscated payload that downloads and runs a Bun runtime to execute the worm outside the Node environment. The malware harvests a broad spectrum of credentials including AWS, Azure, GCP tokens, Kubernetes service account tokens, GitHub PATs, npm publish tokens, and environment variables from approximately 40 CI platforms, as well as password manager stores and local sensitive files. It exfiltrates stolen data to public GitHub repositories controlled by the attacker. Privilege escalation is achieved by exploiting Docker socket access to escape containers and modify sudoers for passwordless sudo access. The worm self-propagates by republishing tampered npm packages using stolen credentials, injecting malicious CodeQL workflows into GitHub repositories, exchanging OIDC tokens for npm publish tokens, and signing artifacts via Sigstore to appear legitimate. Persistence mechanisms include installing daemons and hijacking AI agent and editor configuration files. The malware detects sandbox environments and probes for EDR tools to evade detection. Due to the extensive compromise, any system with this package installed should be considered fully compromised, and all secrets should be rotated from a clean system.

Systems with the affected package versions installed are fully compromised. The attacker gains access to a wide range of sensitive credentials and tokens across multiple cloud providers, CI platforms, password managers, and local files, enabling extensive credential theft. Privilege escalation allows container escape and passwordless sudo access, increasing control over the system. The worm self-propagates by republishing malicious packages and injecting workflows into GitHub repositories, potentially spreading the compromise further. Persistence and evasion techniques make detection and removal difficult. The compromise undermines trust in affected packages and can lead to widespread credential leakage and system takeover.

No official patch or remediation is currently provided. Immediate removal of the affected package versions (=0.6.1, =0.6.2, =0.6.4) is recommended. Due to the full compromise, all secrets and keys stored on affected systems should be rotated immediately from a different, clean computer. Consider the affected systems fully compromised and perform thorough incident response and forensic analysis. Monitor for signs of persistence and unauthorized access. Follow vendor advisories and trusted security sources for updates on remediation or patches.