A supply-chain attack compromised official Red Hat NPM accounts (@redhat-cloud-services) to push backdoored packages...

A supply-chain attack compromised official Red Hat NPM accounts (@redhat-cloud-services) to push backdoored packages that execute during npm install. The worm collects sensitive credentials, including GitHub action secrets, npm tokens, Kubernetes and Vault material, then spreads by republishing to other accounts. The attack is active as of June 1, 2026, and researchers at Aikido and Socket confirm the payload encrypts credentials and exfiltrates them via web requests or compromised GitHub repositories. This directly threatens GitHub users' CI/CD pipelines and secrets. Source: Ars Technica. Additionally, a separate Windows Server vulnerability (CVE-2026-41089) with a public GitHub PoC is being exploited in the wild, further highlighting security risks on the platform. Source: Tom's Hardware. These incidents undermine trust in GitHub's ecosystem for software development and AI infrastructure.