Self-Propagating Worm Infects Red Hat's npm Supply Chain, Steals Cloud Credentials

This attack bypasses traditional defenses by compromising legitimate packages from a trusted vendor—developers who trust Red Hat's official npm scope have no protection against this vector. The malware's self-replication exploits stolen npm tokens to automatically spread across installations, while harvested cloud and CI/CD credentials enable complete infrastructure takeover. Persistence mechanisms embedded in editor configuration files indicate attackers designed this for long-term, multi-stage exploitation.