On June 1, 2026, attackers used a compromised npm token to simultaneously backdoor 31 packages in Red Hat's @redhat-cloud-services npm namespace, publishing malicious versions across the entire frontend ecosystem in under 72 seconds. Armando identified the threat in @redhat-cloud-services/insights-client v4.0.4 -- one of the packages swept up in that window -- finding that the legitimate client library had been entirely overwritten with a 4MB obfuscated eval payload that runs automatically on npm install. With 31,116 total downloads, the package is an established API client in Red Hat Cloud Services frontend pipelines.
Key Findings
- Malicious versions: v4.0.4, v4.0.5, and v4.0.7, all published 2026-06-01; v4.0.3 is clean
- Entry point:
preinstall lifecycle hook fires automatically on npm install
- Targets: Node.js developer environments, CI/CD pipelines, and build systems
- Technique: Entire module source replaced with a single-line ROT-cipher obfuscated eval payload; no user interaction required
- Evasion: Payload addresses and endpoints are runtime-decoded from the obfuscated string array; no plaintext network IOCs are visible to static analysis
- Detection: Script-JS.Infostealer.SupplyChain, Text.Infostealer.SupplyChain, Archive-GZIP.Infostealer.SupplyChain
Package Background
@redhat-cloud-services/insights-client is an API client library for Red Hat Cloud Services, providing access to the Red Hat Insights platform from frontend JavaScript and TypeScript applications. First published on June 12, 2019, the package has accumulated 31,116 downloads and 4 direct dependents over seven years of active development -- enough reach to make it a meaningful supply chain target within the Red Hat Cloud Services ecosystem. The package is maintained under the @redhat-cloud-services npm scope, which is associated with Red Hat's frontend component library at github.com/RedHatInsights/javascript-clients.
The @redhat-cloud-services scope spans dozens of inter-related packages shared across Red Hat's Cloud Services frontend teams. That breadth is exactly what made a compromised npm token so dangerous here: a single credential unlocked the ability to push malicious releases to all 31 packages in the namespace simultaneously.
Attack Analysis
Armando's analysis shows that the attack was executed through a compromised npm token belonging to a publisher account (kruai) with publish rights to the @redhat-cloud-services namespace. Multiple packages across the namespace were published within the same 72-second window on June 1, 2026, in lockstep with one another -- the tight publication cluster is a hallmark of automated token-based injection rather than legitimate development activity.
The attack modified exactly two files: package.json and index.js. The package.json was edited to add a single new field under scripts: "preinstall": "node index.js". That one line is the trigger. Every subsequent npm install of the poisoned version will execute index.js before any other installation step runs.
index.js was the main payload vehicle. In the clean v4.0.3, this file contains the legitimate API client implementation. In v4.0.4, that entire body was replaced with a single line -- a try { eval(...) } call feeding a ROT-cipher decoder function over a long array of integer character codes. The resulting file is approximately 4MB. The ROT-cipher layer is a straightforward character-substitution obfuscation: the decoder rotates each letter by a fixed offset before passing the string to eval, ensuring that static analysis yields only a numeric array rather than readable code.
Behavioral indicators recovered from the package confirm what the obfuscated shell is designed to do. BH13852 (executes files during installation), BH13525 (evaluates code dynamically), BH15358 (contains bytes decodable into a printable string), and BH15183 (converts binary data to string representation) together describe an infostealer profile: code that runs at install time, decodes itself into executable form -- the standard fingerprints of credential harvesting from CI/CD environments, developer workstations, and build pipelines.
Malicious Files
index.js is the primary payload. Armando's analysis found that the entire legitimate module was replaced with a 4MB ROT-cipher obfuscated eval payload. The file registers as Script-JS.Infostealer.SupplyChain. Indicators confirm it evaluates code dynamically at runtime (BH13525), encodes binary data into printable strings (BH15183, BH15358), and executes at install time (BH13852) -- a pattern consistent with credential exfiltration from developer environments and CI/CD systems. Because all endpoint addresses are runtime-decoded, no plaintext network IOCs are recoverable from static analysis alone.
package.json was modified to add the preinstall script entry that references index.js. This file registers as Text.Infostealer.SupplyChain. The addition of "preinstall": "node index.js" is the sole mechanism that causes the payload to execute on install; without this change, index.js would be a passive file. The two-file modification is the minimum footprint required to arm the payload.
Recommendations
Developers and security teams should take the following steps:
- Identify exposure: Check whether
@redhat-cloud-services/insights-client v4.0.4, v4.0.5, or v4.0.7 appears in your dependency tree, including transitive dependencies. Any pipeline that ran npm install while these versions were current (on or after 2026-06-01) should be considered potentially affected. All packages in the @redhat-cloud-services namespace updated on 2026-06-01 should be checked separately.
- Update immediately: Upgrade to v4.0.3 or the latest clean release. Do not rely on v4.0.4, v4.0.5, or v4.0.7.
- Inspect affected systems: On machines that installed the malicious version, treat all environment variables as potentially exfiltrated -- including npm tokens, cloud credentials, API keys, CI/CD secrets, and SSH keys. Rotate any credentials that were present in the environment during the install.
- Audit CI/CD pipelines: If a build pipeline ran
npm install with this version, all secrets available to that pipeline step -- including GITHUB_TOKEN, AWS credentials, registry tokens, and deployment keys -- should be rotated immediately.
- Scan your software supply chain: Use Spectra Assure Community to check whether packages in your environment have been flagged.
Indicators of Compromise
Malicious Files
| Filename | SHA256 | Detection |
|---|
| index.js | 8d2a09b3727b50f3d035b58bd35b90b504d24dda73a8a24e926a010a58ba5f74 | Script-JS.Infostealer.SupplyChain |
| package.json | 4c98879da5f9ec1c020f17b4f0334a8132b0cbc0da35a840489018fe4bdd2d37 | Text.Infostealer.SupplyChain |
Network IOCs
| URL / IP | Purpose |
|---|
| None | Endpoints and attacker addresses are runtime-decoded from the obfuscated string array; not present as plaintext |
Archive Hashes
| File | SHA256 |
|---|
| insights-client-4.0.4.tgz | 9c20a9ab6bc3cfc0632521d5fca2cbaa6a41205af48a5c0a42648e6386ad1555 |
| insights-client-4.0.4.tar | 04c04d8bee8e08a6fdd3e0b5d178578262090971593a5ce3a6b8b42bc0388435 |