Dozens of Red Hat packages backdoored through its official NPM channel
Anyone who has downloaded affected Red Hat packages should investigate immediately.
Signal weather
Rising
Momentum is building quickly, so this card is a good early entry point into the topic.
Official Red Hat NPM accounts have been compromised and used to push a malicious worm that spreads from machine to machine, where it pilfers sensitive credentials in hopes of stealing yet more confidential data, researchers said. The supply-chain attack began Monday and remained active at the time this post went live, according to researchers at security firm Aikido. It’s the result of the threat actor responsible for the hack taking control of @redhat-cloud-services, a legitimate channel in the npm repository that’s reserved for official Red Hat packages. As such, the channel is widely trusted by developers who rely on Red Hat cloud services. The vicious cycle of today’s supply-chain attacks It’s unclear precisely how the threat actor took control of the namespace, but it almost certainly involved the compromise of credentials required to access it, possibly through a previous supply-chain attack. More than 30 packages seem to be affected. Read full article Comments
Stay on the signal
Follow Dozens of Red Hat packages backdoored through its official NPM channel
Follow this story beyond a single article: new follow-ups, adjacent sources, and the evolving storyline.
Story map
Understand this topic fast
A quick entry into the story: why it matters now, who is involved, and where to go next for context.
Why it matters now
Topic constellation
Open the live map for this story
See which entities, story threads, sources, and follow-up articles shape this story right now.
Click nodes to continue
Entity pages
Story timeline
Continue with this story
A short sequence of events and follow-up stories to understand the arc quickly.
How reliable this looks
Signal and trust for Ars Technica
This source works at a steady pace: 100% of recent stories land in the hot window, and 0% carry visible search signal.
Reliability
92
Freshness
100
Sources in storyline
2
Related articles
More stories that share tags, source, or category context.
Michigan politicians want to ban Chinese-badged cars from even visiting the US
The latest bill would ban day trips from Canada or Mexico in Chinese cars.
Signal weather
Momentum is building quickly, so this card is a good early entry point into the topic.
Why now
Fresh coverage with immediate momentum.
The weather and climate science AI revolution isn’t revolutionary
Machine learning has its limits—how is it being used?
Signal weather
Momentum is building quickly, so this card is a good early entry point into the topic.
Why now
Fresh coverage with immediate momentum.
RIP Anthony Head: Our 10 favorite moments of Buffy’s Giles
Head's true genius—and that of his character, Giles—lay in quietly filling in the gaps in every scene
Signal weather
Momentum is building quickly, so this card is a good early entry point into the topic.
Why now
Fresh coverage with immediate momentum.
School shooting survivor sues AI gun detection firm after system failed to spot weapon
How accurate does an AI system need to be?
Signal weather
Momentum is building quickly, so this card is a good early entry point into the topic.
Why now
Fresh coverage with immediate momentum.
More from Ars Technica
Fresh reporting and follow-up coverage from the same newsroom.
Michigan politicians want to ban Chinese-badged cars from even visiting the US
The latest bill would ban day trips from Canada or Mexico in Chinese cars.
Signal weather
Momentum is building quickly, so this card is a good early entry point into the topic.
Why now
Fresh coverage with immediate momentum.
"Chat is dead": OpenAI preps overhaul of ChatGPT
OpenAI to recast hit chatbot as a route to higher-margin products before a potential IPO.
Signal weather
Momentum is building quickly, so this card is a good early entry point into the topic.
Why now
Fresh coverage with immediate momentum.
The weather and climate science AI revolution isn’t revolutionary
Machine learning has its limits—how is it being used?
Signal weather
Momentum is building quickly, so this card is a good early entry point into the topic.
Why now
Fresh coverage with immediate momentum.
RIP Anthony Head: Our 10 favorite moments of Buffy’s Giles
Head's true genius—and that of his character, Giles—lay in quietly filling in the gaps in every scene
Signal weather
Momentum is building quickly, so this card is a good early entry point into the topic.
Why now
Fresh coverage with immediate momentum.