Dozens of Red Hat packages backdoored through its official NPM channel

The report describes an active supply-chain malware campaign centered on a worm called Shai-Hulud, released publicly and used by the threat group TeamPCP to target CI/CD pipelines (notably GitHub Actions OIDC) and harvest CI/CD and cloud credentials; Red Hat removed malicious internal packages after detection, and organizations touching affected packages are advised to assume compromise of workstations, pipelines, and credentials.