Red Hat npm package compromised to steal developer credentials

Greater than 30 npm packages in Purple Hat’s “@redhat-cloud-services” namespace have been compromised in a provide chain assault that distributed a brand new variant of Shai-Hulud credential stealing malware known as “Miasma.”

The incident was found by safety corporations Aikido and OX Safety, which found dozens of bundle variations with backdoors with malware designed to steal developer credentials, cloud secrets and techniques, SSH keys, CI/CD tokens, and different delicate info.

In line with Aikido, roughly 117,000 compromised packages are downloaded every week.

In a press release shared with BleepingComputer, Purple Hat mentioned it eliminated the affected packages after turning into conscious of the incident and that the compromise was restricted to internally developed instruments.

“Purple Hat is conscious of a safety bulletin concerning sure npm packages inside our growth instruments ecosystem. We instantly started an investigation and eliminated the packages from the npm registry,” Purple Hat informed BleepingComputer.

“The bundle is strictly for inside growth, and no malicious code has ever been uncovered for buyer use by way of the console.redhat.com system. The investigation is ongoing, however we now have not seen any affect to buyer or associate environments or Purple Hat manufacturing methods.”

The corporate says it’s persevering with to research the incident, however didn’t reply to questions on how the accounts have been compromised.

Purple Hat packages backdoored on account of GitHub breach

In line with Aikido, the attackers allegedly compromised a Purple Hat worker’s GitHub account and used it to push malicious commits on to a number of repositories.

These commits added a GitHub Actions workflow and a script that exploits npm’s publishing mechanism to launch backdoor packages.

“When the workflow runs, Bun might be put in and run _index.jsgo the record of goal packages by way of the OIDC_PACKAGES surroundings variable,” Aikido explains.

“The script makes use of the id-token: write permission to request a short-lived OIDC token from GitHub, makes use of that token to authenticate instantly with npm’s trusted publishing endpoint, and publishes backdoor variations of all packages within the record.”

These compromised packages contained a malicious “preinstallation script” that routinely executed a extremely obfuscated malicious Index.js file when a developer put in the bundle.

"scripts": {
  "preinstall": "node index.js"
}

In line with Aikido, the “index.js” payload is roughly 4.2 MB in dimension and consists of GitHub Actions secrets and techniques, AWS credentials, Google Cloud credentials, Azure service principal credentials, HashiCorp Vault tokens, Kubernetes service account tokens, npm and PyPI public tokens, SSH keys, Docker credentials, GPG keys, and a `.env` file.

In line with Aikido, 32 packages and 96 bundle variations have been affected by the compromise, together with quite a few consumer libraries managed within the “@redhat-cloud-services” namespace.

Organizations which have put in the affected model are inspired to instantly rotate all credentials, secrets and techniques, and tokens utilized by code on contaminated gadgets.

Miasma seems to be a brand new Shai-Hulud variant

Over the previous few months, we have seen a lot of provide chain assaults that leverage the Shai-Hulud malware to steal credentials and unfold to different tasks.

These assaults affected well-known tasks resembling Bitwarden, SAP, Mistral, TanStack, OpenAI, and GitHub.

In Might, the TeamPCP menace group revealed the supply code of the Mini Shai-Hulud malware framework, making the malware out there to different menace actors.

Researchers say the malware used within the Purple Hat breach shares many similarities with Mini Shai-Hulud, however makes use of the string “Miasma: The Spreading Blight” as a touch upon the compromised GitHub repository.

The malware is just like TeamPCP’s Mini Shai-Hulud, however it’s unclear whether or not this marketing campaign was carried out by that menace actor or one other menace actor who modified the leaked malware’s supply code.

In line with OX Safety, the malware retains the identical credential stealing capabilities as Mini Shai-Hulud, however provides extra obfuscation layers, multi-stage payload supply mechanisms, and enhanced information theft and credential harvesting capabilities.

As of this writing, 309 GitHub repositories have been compromised by the Miasma malware marketing campaign.