Red Hat cloud services npm packages were compromised in a supply chain attack that used a preinstall script to steal developer and CI secrets.