Sigstore

Mentions · 7d0
Mentions · 30d0
All mentions1
First seenSep 21, 2026
Last mentionedSep 21, 2026

Timeline

1 articles · newest first

Attackers Abuse npm Trusted Publishing in GHAPPIER Campaign

Attackers abused npm trusted publishing to ship the GHAPPIER loader via a legitimate package in the North Korea-linked PolinRider campaign.

Infosecurity MagazineSep 21, 13:30 UTC · Sep 21, 2026MalwareExploited3 · 2 reads

Appears with

GitHuborganization · 1
npmorganization · 1
CloudSEKorganization · 1
GitHub Actionsproduct · 1
CloudSEKvendor · 1
PolinRiderthreat actor · 1
PolinRidermalware · 1
GHAPPIERmalware · 1
npmproduct · 1
@dforge-core/dforge-mcpproduct · 1
North Koreaorganization · 1

Entities are extracted by the model from each article. First seen Sep 21, 2026, last mentioned Sep 21, 2026. Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.