Dozens Of Red Hat Packages Backdoored Through Its Official NPM Channel
Arthur T Knackerbracket writes:
Official Red Hat NPM accounts have been compromised and used to push a malicious worm that spreads from machine to machine, where it pilfers sensitive credentials in hopes of stealing yet more confidential data, researchers said.
The supply-chain attack began Monday and remained active at the time this post went live, according to researchers at security firm Aikido. It's the result of the threat actor responsible for the hack taking control of @redhat-cloud-services, a legitimate channel in the npm repository that's reserved for official Red Hat packages. As such, the channel is widely trusted by developers who rely on Red Hat cloud services.
It's unclear precisely how the threat actor took control of the namespace, but it almost certainly involved the compromise of credentials required to access it, possibly through a previous supply-chain attack. More than 30 packages seem to be affected.
The packages execute an obfuscated payload that can run during the npm install process, which occurs before a developer imports or actually uses the package in a production environment. Security firm Socket said an analysis of the malware revealed that it's designed to collect sensitive credentials, including GitHub action secrets, npm tokens, Kubernetes and Vault material, and credentials for other cloud services. The worm then spreads by republishing backdoored packages to third-party accounts the infected device has access to. Most, but not all, of the packages had been taken down in the hours following the incident.
"Organizations should treat any system that installed one of the affected @redhat-cloud-services package versions as potentially compromised," Socket researchers wrote. "The payload executes during npm install, before application code imports or uses the package, so exposure depends on installation or CI execution, not runtime use."
Once a system is infected, it encrypts the credentials and sends them through a web request. A fallback mechanism allows the malware to publish the encrypted data into a compromised GitHub repository, assuming it has possession of the credentials for it.
The worm, dubbed Shai-Hulud, has all the hallmarks of malware released last month as freely available open source. TeamPCP was the first group to use Shai-Hulud, and it promoted a competition that promised a $1,000 payment to the hacker who carried out the biggest supply-chain attack using the malware. TeamPCP has also been behind a rash of previous supply-chain attacks. Now that the worm is in the hands of many other threat groups, supply-chain attacks may ramp up further.
The malware devotes considerable attention to CI/CD (continuous integration/continuous delivery) systems, which allow for faster and more reliable software releases by automating the building, testing, and deploying of code changes. The malware spread in Monday's attack was published through GitHub Actions OIDC (OpenID Connect), indicating that Red Hat's CI/CD pipeline was compromised. OIDC is a security measure designed to interact with cloud services through the use of temporary credentials.
Once installed, the malware targets other organizations' CI/CD credentials. The compromise of Red Hat's GitHub Actions OIDC was very possibly the result of a previous supply-chain attack that infected an employee's machine.
Read more of this story at SoylentNews.