Compromised npm packages targeted Red Hat cloud services, enabling credential theft and expanding supply chain risks.