Loading story…
Attackers compromised a maintainer account for the legitimate @dforge-core/dforge-mcp npm package, altered its release workflow, and published the previously unreported GHAPPIER loader in version 0.2.21. The release carried valid GitHub Actions OIDC provenance because the adversary had repository push access and used the trusted CI identity, rather than exploiting GitHub, npm, or the package’s trusted-publishing mechanism. GHAPPIER activates when the MCP server starts and executes a four-stage chain culminating in a self-deleting, general-purpose remote shell.
CloudSEK reported that the activity involved 65 repositories and 22 accounts across GitHub and npm, and assessed related payloads as operating alongside the DPRK-linked PolinRider campaign; independent confirmation of North Korean attribution and successful victim compromises was not available. Organizations should pin @dforge-core/dforge-mcp to version 0.2.22, treat lockfiles referencing 0.2.21 as a potential exposure indicator, investigate residual payload-chain artifacts, and monitor package release workflows for unauthorized trigger or publishing changes.
Trace attribution and downstream blast radius.
6 events from the most recent confirmed update back to the earliest known activity.
CloudSEK reported the previously unreported GHAPPIER loader campaign, identifying at least 65 public repositories, 73 infected files, and 22 accounts. It linked related payloads to PolinRider but could not independently confirm reported North Korean attribution, and found no evidence of a successful organizational compromise.
Fourteen minutes after modifying workflow triggers so every push to main invoked the release workflow, the attacker rewrote the workflow to enable unattended publishing. The resulting valid provenance attestation reflected the CI build environment, not whether the committed code was benign.
Attackers distributed the GHAPPIER loader through version 0.2.21 of the legitimate @dforge-core/dforge-mcp package using GitHub Actions OIDC trusted publishing. The release was the latest version for 35 minutes and 38 seconds; GHAPPIER executed only when the MCP server launched and ultimately deployed a self-deleting remote shell.
The attacker issued an initial malicious release of @dforge-core/dforge-mcp version 0.2.20, but the release failed and broke package installation.
An attacker used the @dforge-core/dforge-mcp maintainer account for 105 minutes and already had permission to push to the repository's main branch. CloudSEK could not determine how access was obtained.
OpenSourceMalware had tracked the PolinRider payload campaign since March 2026. A payload found in a separate victim repository later exactly matched this campaign.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A report from OpenSource Malware says the DPRK-linked **PolinRider** campaign compromised legitimate GitHub maintainer accounts and used them to publish malicious npm releases, highlighting a case involving developer **DiogoAngelim** and the packages `fetch-page-assets` and `html-to-gutenberg`. The report says `fetch-page-assets` version `1.2.9` was identified and removed under advisory `GHSA-vxq2-vhm7-7mhq`, but attackers continued publishing malicious versions `1.2.10` through `1.2.14`, with payloads tied to **PolinRider/NullReceiver** concealed in files including `.vscode/tasks.json`, a fake `.woff2` font, and later `babel.config.cjs`. The article says the compromise extended beyond a single package: all seven non-archived public repositories under the maintainer’s account were allegedly reinfected in coordinated force-push waves, indicating sustained attacker control over both the GitHub account and build environment. OpenSource Malware estimates the campaign has reached **4,367 repositories across 2,152 owners** and argues that current GitHub and npm response mechanisms, which focus on removing specific malicious versions, are insufficient when attackers retain control of trusted maintainer accounts and can repeatedly ship new poisoned releases.
Aug 25, 2026
Attackers linked by multiple researchers to **TeamPCP** hijacked the npm maintainer account `atool` and used it to publish roughly **639 malicious versions across 323 packages**, heavily impacting Alibaba’s **`@antv/*`** ecosystem as well as packages such as `echarts-for-react`, `timeago.js`, and `size-sensor`. Reports said the malware executed through malicious `preinstall` hooks and an obfuscated Bun-based payload, stealing secrets from developer workstations and CI/CD systems including GitHub, npm, AWS, Kubernetes, Vault, SSH, Docker, and database credentials. The campaign also abused GitHub tokens to create attacker-controlled repositories for exfiltration, scraped GitHub Actions runner memory for plaintext secrets, and in some cases targeted trusted tooling including a briefly compromised **Nx Console** VS Code extension. Researchers said the operation was worm-like and self-propagating, using stolen npm tokens to tamper with and republish additional packages under legitimate maintainer identities, with the broader **Mini Shai-Hulud** activity now tracked across npm, PyPI, and Composer. The malware reportedly established persistence in developer environments through modified VS Code and Claude Code settings and OS-level services, while some reports warned it also attempted to forge valid **Sigstore/SLSA provenance** using stolen CI identities. In response, **npm invalidated all write-enabled granular access tokens that bypassed two-factor authentication** and introduced **Staged Publishing** in preview, but researchers warned that any machine or pipeline that installed affected versions should be treated as fully compromised and all reachable credentials rotated immediately.
Jun 29, 2026
Researchers reported that the **Mini Shai-Hulud** campaign compromised widely used developer packages across **npm, PyPI, and Packagist/Composer**, including SAP CAP components, `intercom-client`, `intercom/intercom-php`, and PyTorch Lightning’s `lightning` package. The malicious releases delivered an obfuscated credential stealer executed with the **Bun** runtime, harvesting secrets from developer workstations and CI/CD environments, including GitHub, npm, cloud, Kubernetes, and AI tooling credentials. Stolen data was encrypted and exfiltrated through attacker-created public GitHub repositories, and the campaign was linked by multiple researchers to **TeamPCP**. Reports estimated exposure ranging from more than **1,000** to roughly **1,800 repositories**, with no `CVE`, `GHSA`, or `OSV` identifiers assigned at disclosure. Investigators said the attackers abused software publishing workflows rather than relying solely on direct maintainer compromise, including a stolen npm token tied to SAP’s `cloudmtabot` account, an exposed token in CircleCI pull-request builds, and overly broad GitHub and npm **OIDC trusted publishing** policies. The malware propagated by using stolen npm tokens to publish infected patch versions of additional packages and established persistence through developer tooling by planting `.vscode/tasks.json` entries with `"runOn": "folderOpen"` and `.claude/settings.json` `SessionStart` hooks, a technique compared to the earlier **PolinRider/TasksJacker** tradecraft. Maintainers released cleaned package versions, while defenders were urged to rotate credentials, review GitHub, npm, and cloud activity, harden OIDC publishing rules, pin dependencies, and hunt repositories for unauthorized `folderOpen` tasks and Claude hooks.
Jun 29, 2026