@redhat-cloud-services publish pipeline is compromised today and shipped a signed, trusted, malicious npm package

patch-client@4.0.4 went out through the project's own github action OIDC trusted publisher today and not any stolen token or a typosquat anything, we saw that the actual release pipeline produced it. this runs on npm install, steals cloud creds and self propagates by injecting fake CodeQL workflows into repository the stolen tokens can reach. 32 packages is currently sharing the same publisher so the window of exposure isn not only just a single package. if you have anything from related to / redhat-cloud-services in your tree, 4.0.3 is the last clean version. submitted by /u/BattleRemote3157 [link] [留言]