RedHat npm Publisher Compromised: Supply Chain Attack Impacts 32 Packages

This attack exploits a fundamental flaw in npm's OIDC trust model: when a legitimate publisher account is compromised, the malicious code inherits all the trust granted to that publisher. The incident impacts 32 packages sharing the same OIDC identity, and the malware's self-propagating design—injecting fake CodeQL workflows to harvest credentials—demonstrates how supply chain attacks can cascade across entire development ecosystems with minimal friction.