Threats Tagged 'trapdoor'

A supply chain attack targeted multiple @redhat-cloud-services npm packages by embedding malicious payloads that execute automatically during package installation via preinstall hooks. The malware uses AES-GCM encrypted payloads and obfuscated JavaScript loaders to steal sensitive credentials and secrets including GitHub Actions secrets, npm tokens, cloud provider credentials (AWS, Azure, GCP), Kubernetes and Vault data, SSH keys, Git credentials, and cryptocurrency wallet files. It can persist on developer workstations as a daemon, avoids execution in Russian locales, and exfiltrates stolen data over encrypted HTTPS with fallback to GitHub API channels. The campaign mimics tactics from the publicly available Shai-Hulud toolkit, but attribution remains unclear due to open-source availability of the attack tools. No patch or official remediation guidance is currently provided.