Official "@redhat-cloud-services" npm packages were compromised and republished on 2026-06-01 via the "RedHatInsights/javascript-clients" GitHub Actions OIDC publishing flow. Each malicious version registers a "preinstall" hook that fires automatically on "npm install" and executes a multi-stage credential harvester targeting GitHub Actions secrets, AWS, GCP, Azure, Kubernetes, HashiCorp Vault, npm tokens, and CircleCI tokens. The payload explicitly attempts to evade StepSecurity Harden-Runner detection. Pin each affected package to the last known-good version published prior to the compromise.