Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Software Composition Analysis (SCA) services are automated tools that scan codebases to find, identify, and manage open-source components, detecting security vulnerabilities (CVEs), licensing issues, and outdated libraries. They help teams maintain secure, compliant software by creating a software bill of materials (SBOM) and shifting security left in the development lifecycle (DevSecOps). Top providers include Mend.io, Snyk, and Checkmarx.

On June 1, 2026, multiple npm packages in the @redhat-cloud-services scope were published with malicious versions. Each tarball ships a 4.1 MB obfuscated JavaScript file added to package.json as a preinstall hook. The hook runs a multi-stage loader that ends in a Bun-executed credential stealer hitting AWS, Azure, GCP, HashiCorp Vault, Kubernetes, GitHub Actions OIDC, npm, Bitwarden, and 1Password.