GHAPPIER Supply Chain Attack Compromises 65 GitHub Repositories and Poisons npm Package
GHAPPIER supply chain campaign compromised 65 GitHub repositories and pushed a malicious four-stage npm loader via compromised maintainer trusted publishing.
CloudSEK tracked the GHAPPIER operation, which reached 65 GitHub repositories across 22 accounts; on September 9 an intruder used the @dforge-core/dforge-mcp maintainer account for 105 minutes to publish version 0.2.21 containing a four-stage remote code loader. The poisoned release stayed live 35 minutes, carried valid npm provenance via GitHub Actions OIDC trusted publishing, and its final stage self-deleted to evade disk searches, with stages still responding five days later. A second payload family matched the PolinRider campaign, which harvests cached Git credentials and reads C2 configuration from an Ethereum blockchain transaction. No downstream organizational compromise was confirmed; users should pin version 0.2.22 and audit for 0.2.21.