Red Hat npm Supply Chain Compromised by Worm
NEOSEC enrichment — no mirror of the original source
On Monday, June 1, 2026, a credential-stealing worm was distributed in npm packages published in the official @redhat-cloud-services channel. According to ReversingLabs, "the affected packages collectively represent approximately 9.8 millio
Source: SANS NewsBites. For licensing reasons NEOSEC Intel does not mirror the full text verbatim. The full text and expert commentary are available at the original source.
Read the issue at SANS NewsBitesMore on Compromised
Other advisories
- Not ratedosv:CLEANSTART-2024-BH66439compromised content process could have performed session history manipulations it should not have been able to due to testing infrastructure that was not restricted to testing-only configurations
- Not ratedosv:CLEANSTART-2024-AH68885fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the confidentiality and integrity of the guest virtual machine
- Not ratedosv:CLEANSTART-2026-RB02560WebFlux application with a compromised subdomain (for example, compromised via cross-site scripting (XSS)) is vulnerable to an escalation attack exchanging a known session ID for that of an authent...
- Not ratedosv:CLEANSTART-2024-DK66902As part of a winning Pwn2Own entry, a researcher demonstrated a sandbox escape by installing a malicious language pack and then opening a browser feature that used the compromised translation
- Not ratedosv:CLEANSTART-2024-DY60209compromised content process could send a message to the parent process that would cause the 'Click to Play' permission prompt to be shown
- Not ratedosv:CLEANSTART-2024-UQ28182compromised content process could have performed session history manipulations it should not have been able to due to testing infrastructure that was not restricted to testing-only configurations
- Not ratedosv:CLEANSTART-2024-UQ62409By generally accepting and passing resource handles across processes, a compromised content process might have confused higher privileged processes to interact with handles that the unprivileged pr...
- Not ratedosv:CLEANSTART-2024-KC30952If a compromised content process sent an unexpected number of WebAuthN Extensions in a Register command to the parent process, an out of bounds write would have occurred leading to memory corruptio...
Other news entries
- Technical University of Munich (TUM) IT security incident: myTUM passwords stolen, TUMonline taken offlineBreachpwn.watch
- Cyberattack Hits French Blood Bank Site but No Blood Products Are CompromisedNewsSecurityWeek
- Building incident playbooks for machine identity breachesNewsCSO Online
- Attackers turned OpsShield’s trusted update channel into a supply-chain attackNewsCSO Online
- Binance says hackers who stole billions in crypto spent months planning heistNewsArs Technica — Security
- Binance says hackers who stole billions in crypto spent months planning the heistNewsArs Technica — Security
- APT29-Linked Hackers Hijack Web Analytics Script to Deliver iOS and Android ExploitsNewsThe Hacker News
- US charges two Canadians accused of hacking US universitiesNewsBleepingComputer
Source: https://access.redhat.com/
ID