This threat involves malicious code injected into the @redhat-cloud-services/patch-client npm package (versions 4.0.4, 4.0.5, and 4.0.7) as part of a supply chain worm campaign targeting the GitHub Actions OIDC trusted publisher shared by Red Hat Cloud Services npm packages. The attacker inserted a preinstall hook delivering a multi-layer obfuscated payload that downloads a Bun runtime to execute the worm outside the Node environment. The malware harvests extensive credentials and tokens from AWS, Azure, GCP, HashiCorp Vault, Kubernetes, GitHub, npm, various CI platforms, password managers, and local files, exfiltrating data to public GitHub repositories. It escalates privileges by exploiting Docker socket access to gain passwordless sudo for CI runner accounts. Self-propagation occurs through republishing tampered npm packages, injecting malicious CodeQL workflows via GitHub GraphQL API, and signing artifacts with Sigstore to appear legitimate. Persistence mechanisms include daemon installation and hijacking of AI agent and editor configuration files. The malware also detects sandbox and EDR environments to evade analysis and detection. Due to the extensive compromise, affected systems should be treated as fully compromised with immediate secret rotation and package removal.

The impact is severe as the malware compromises system integrity and confidentiality by harvesting a broad range of sensitive credentials and tokens across multiple cloud providers, CI platforms, and local environments. It enables privilege escalation to gain elevated access on affected systems. The worm self-propagates by tampering with npm packages and GitHub workflows, increasing the attack surface and persistence. The presence of this malware means full system compromise, with attacker control potentially established beyond the initial infection. Credential theft and privilege escalation facilitate further lateral movement and data exfiltration. The malware's evasion techniques reduce the likelihood of detection by security tools.

No official patch or fix is currently documented for this malicious package compromise. Immediate mitigation requires removing the affected @redhat-cloud-services/patch-client package versions 4.0.4, 4.0.5, and 4.0.7 from all systems. All credentials, tokens, and secrets stored or accessible on compromised systems must be rotated immediately from a separate, trusted environment. Due to the high likelihood of full system compromise, consider rebuilding affected systems from known good backups or reinstalling operating systems. Monitor for signs of persistence such as daemons in /tmp/kitty-<random> and hijacked configuration files (.claude/settings.json, .vscode/tasks.json). Review GitHub repositories for unauthorized CodeQL workflows and revoke any suspicious tokens or credentials. Follow vendor and security community advisories for updates on remediation and detection.