Red Hat npm Supply Chain Compromised by Worm
NEOSEC enrichment — no mirror of the original source
On Monday, June 1, 2026, a credential-stealing worm was distributed in npm packages published in the official @redhat-cloud-services channel. According to ReversingLabs, "the affected packages collectively represent approximately 9.8 millio
Source: SANS NewsBites. For licensing reasons NEOSEC Intel does not mirror the full text verbatim. The full text and expert commentary are available at the original source.
Read the issue at SANS NewsBitesMore on Compromised
Other advisories
- LowCVE-2026-125349Uninitialized resource in GPU in Google Chrome on on Android prior to 157.0.8103.50 allowed a remote attacker who had compromised the renderer process to rea…
- HighCVE-2026-125343Buffer overflow in Compositing in Google Chrome prior to 157.0.8103.50 allowed a remote attacker who had compromised the renderer process to execute arbitrar…
- HighCVE-2026-114359Eclipse Kura downloads deployment packages (DPs) from a remote URL without any limit on the size of the data it receives. A malicious or compromised HTTP(S) …
- Not ratedosv:CLEANSTART-2026-YD54961security issue was discovered in Kubernetes where a malicious or compromised pod could bypass network restrictions enforced by network policies during namespace deletion
- MediumCVE-2026-121125Information leak in ServiceWorker in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to obtain sensit…
- HighCVE-2026-121167Incorrect authorization in Permissions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to bypass s…
- MediumCVE-2026-121091Incorrect authorization in Permissions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to obtain s…
- MediumCVE-2026-121194Missing authorization in SiteIsolation in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to obtain s…
Other news entries
- New malware doesn’t call home, it turns your Exchange server into its homeNewsCSO Online
- F-Secure Identifies 26 Ways AI Can Harm Consumers, and Where to Stop ThemNewsDark Reading
- Hackers exploit trusted AWS access to breach multiple cloud environmentsNewsBleepingComputer
- Over a Dozen Organizations Hit in Qubole Supply Chain AttackNewsSecurityWeek
- Improper neutralization of special elements used in an ldap queryNewsFortinet PSIRT
- Iris Plaza Breach May Have Exposed Data of 7.7 Million CustomersNewsSecurityWeek
- Technical University of Munich (TUM) IT security incident: myTUM passwords stolen, TUMonline taken offlineBreachpwn.watch
- Cyberattack Hits French Blood Bank Site but No Blood Products Are CompromisedNewsSecurityWeek
Source: https://access.redhat.com/
ID