Red Hat packages backdoored through its offical NPM channel
arstechnica.com