Hackers hid malware inside a batch of Red Hat npm packages, and it steals your logins the moment you install them. Security firm StepSecurity reported the attack on June 1, 2026. The packages live on npm, the giant shared code library where JavaScript developers grab ready-made building blocks. These ones came under the name Red Hat uses for its cloud tools, so they looked safe.
The trap springs the second you run the install. No clicking is needed. The bad code wakes up on its own, before your own program even starts. Then it hunts for keys and passwords across your machine. It grabs GitHub secrets and login tokens for Amazon, Google Cloud, Microsoft Azure, and more, then ships them off to whoever planted it.
Built to hide and spread on its own
The attackers worked hard to stay out of sight. One package StepSecurity took apart had an install file that was 4.2 megabytes when it should have been a few kilobytes. The rest was filler wrapped around the real payload in three layers. Each layer scrambles the code so a person reading it cannot tell what it does. The malware even tries to switch off StepSecurity's own protection tool.
It also spreads all on its own, which makes it far worse. Once it has your npm tokens, it uses them to publish poisoned copies of other packages, with no help from the attacker. It even slips past accounts locked with two-factor login, the second code you normally type to prove it is really you. So every infected machine quietly seeds the next round of victims.
Who is hit and what to do
This is a developer problem first, but it reaches anyone whose stolen keys unlock real systems. The bad uploads trace back to several Red Hat code projects, including its javascript-clients repository. In all, 64 bad versions turned up across 32 packages, two tainted versions each. The list includes common names like chrome, frontend-components, and entitlements-client.
If you pulled any of these lately, treat your secrets as burned. Change every cloud and login token the malware goes after. Check your npm account for versions you never published, and lock to a known-good release instead of the newest one. When StepSecurity wrote this up, Red Hat had not put out a warning yet, and the rest of the packages were still being checked. Check before you install. One install is all it takes.
