Eight packages in the @redhat-cloud-services npm scope were compromised with malicious payloads that execute via preinstall hooks during npm install. The attack involves a sophisticated multi-stage credential harvester targeting GitHub Actions secrets, AWS, GCP, Azure, Kubernetes, HashiCorp Vault, npm tokens, and CircleCI tokens. Multiple versions across RedHat Cloud Services frontend ecosystem packages are affected. This represents a significant supply chain compromise affecting enterprise cloud infrastructure credentials.