{"id":15362,"date":"2026-06-03T00:02:41","date_gmt":"2026-06-03T00:02:41","guid":{"rendered":"https:\/\/techtrendfeed.com\/?p=15362"},"modified":"2026-06-03T00:02:41","modified_gmt":"2026-06-03T00:02:41","slug":"dozens-of-purple-hat-packages-backdoored-by-way-of-its-official-npm-channel","status":"publish","type":"post","link":"https:\/\/techtrendfeed.com\/?p=15362","title":{"rendered":"Dozens of Purple Hat packages backdoored by way of its official NPM channel"},"content":{"rendered":"


\n
<\/p>\n

Official Purple Hat NPM accounts have been compromised and used to push a malicious worm that spreads from machine to machine, the place it pilfers delicate credentials in hopes of stealing but extra confidential knowledge, researchers mentioned.<\/p>\n

The availability-chain assault started Monday<\/a> and remained lively on the time this publish went reside, based on researchers at safety agency Aikido. It\u2019s the results of the risk actor answerable for the hack taking management of @redhat-cloud-services, a official channel within the npm repository that\u2019s reserved for official Purple Hat packages. As such, the channel is broadly trusted by builders who depend on Purple Hat cloud providers.<\/p>\n

The vicious cycle of at the moment\u2019s supply-chain assaults<\/h2>\n

It\u2019s unclear exactly how the risk actor took management of the namespace, nevertheless it nearly actually concerned the compromise of credentials required to entry it, presumably by way of a earlier supply-chain assault. Greater than 30 packages appear to be affected.<\/p>\n

Learn full article<\/a><\/p>\n

Feedback<\/a><\/p>\n\n","protected":false},"excerpt":{"rendered":"

Official Purple Hat NPM accounts have been compromised and used to push a malicious worm that spreads from machine to machine, the place it pilfers delicate credentials in hopes of stealing but extra confidential knowledge, researchers mentioned. The availability-chain assault started Monday and remained lively on the time this publish went reside, based on researchers […]<\/p>\n","protected":false},"author":2,"featured_media":15364,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[54],"tags":[9298,564,6007,2502,1116,115,2987,2501],"class_list":["post-15362","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-tech-news","tag-backdoored","tag-channel","tag-dozens","tag-hat","tag-npm","tag-official","tag-packages","tag-red"],"_links":{"self":[{"href":"https:\/\/techtrendfeed.com\/index.php?rest_route=\/wp\/v2\/posts\/15362","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/techtrendfeed.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/techtrendfeed.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/techtrendfeed.com\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/techtrendfeed.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=15362"}],"version-history":[{"count":1,"href":"https:\/\/techtrendfeed.com\/index.php?rest_route=\/wp\/v2\/posts\/15362\/revisions"}],"predecessor-version":[{"id":15363,"href":"https:\/\/techtrendfeed.com\/index.php?rest_route=\/wp\/v2\/posts\/15362\/revisions\/15363"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/techtrendfeed.com\/index.php?rest_route=\/wp\/v2\/media\/15364"}],"wp:attachment":[{"href":"https:\/\/techtrendfeed.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=15362"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/techtrendfeed.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=15362"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/techtrendfeed.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=15362"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}