GHAPPIER Supply Chain Attack Compromises 65 GitHub Repositories and Poisons npm Package
GHAPPIER supply chain campaign compromised 65 GitHub repositories and pushed a malicious four-stage npm loader via compromised maintainer trusted publishing.
CloudSEK tracked the GHAPPIER operation, which reached 65 GitHub repositories across 22 accounts; on September 9 an intruder used the @dforge-core/dforge-mcp maintainer account for 105 minutes to publish version 0.2.21 containing a four-stage remote code loader. The poisoned release stayed live 35 minutes, carried valid npm provenance via GitHub Actions OIDC trusted publishing, and its final stage self-deleted to evade disk searches, with stages still responding five days later. A second payload family matched the PolinRider campaign, which harvests cached Git credentials and reads C2 configuration from an Ethereum blockchain transaction. No downstream organizational compromise was confirmed; users should pin version 0.2.22 and audit for 0.2.21.
- 65 GitHub repositories, 73 files, and 22 accounts affected by GHAPPIER
- Malicious npm package 0.2.21 distributed four-stage loader with valid provenance attestation
- Final payload self-deleted but stages still responded five days later
- Linked PolinRider payload uses Ethereum blockchain transaction for C2
Full article733 words · extracted from cybersecuritynews.com · click to collapse
A newly uncovered software supply chain attack has shown how quickly a trusted developer account can become a delivery route for malware.
The operation, tracked as GHAPPIER, reached 65 GitHub repositories, infecting 73 files across 22 accounts. It involved a legitimate npm package that distributed a malicious loader to users.
Attackers used access to a package maintainer account to alter source code and automate publication from the project’s main branch.
The poisoned release appeared legitimate because it was built through the project’s automated publishing process. That made a routine dependency update capable of carrying a remote code loader into developer environments.
CloudSEK said in a report shared with Cyber Security News (CSN) that the incident began on September 9, when an intruder used the maintainer account of @dforge-core/dforge-mcp for 105 minutes.
The researchers could not confirm how access was obtained, but said an infected developer machine, extension, or package was a plausible route to the credentials.
The case matters beyond the npm release. It highlights why trusted publishing, source control access, and developer devices belong to the same security boundary.
Malicious GitHub workflow campaigns show how attackers can turn automation into a route for credential theft and wider repository compromise.
GHAPPIER Supply Chain Attack
During the intrusion, the threat actor inserted a remote loader, changed three lines so pushes to the main branch would start a release workflow, then rewrote that workflow for unattended publication.
The malicious @dforge-core/dforge-mcp version 0.2.21 remained the latest registry release for 35 minutes and 38 seconds before the maintainer restored the project and released clean version 0.2.22.
The altered package carried valid npm provenance. GitHub Actions created it using OpenID Connect trusted publishing, and its attestation in Sigstore recorded the attacker’s commit.
The record could not show that code entering the build was safe. Write access to the repository became publishing access, a risk also seen when npm packages are compromised at scale.
The loader was hidden in one line near line 3,320 of a 99 KB file and started a four-stage chain. Its final component deleted itself, reducing the chance that a disk search would find the implant. The researchers said all stages still responded when tested five days after the package was withdrawn.
CloudSEK’s wider review connected a second payload family in another victim repository to PolinRider, a documented campaign that silently appends code to real project configuration files.
The payload reads command-and-control information from an Ethereum blockchain transaction rather than using a normal domain or host. The report noted that an exact match was still beaconing when the research was written.
The researchers said the observed pattern may explain the initial account takeover. PolinRider has been documented harvesting cached Git credentials from infected machines, allowing an attacker to push code under a developer’s identity.
That possibility illustrates why developer endpoint protection matters as much as repository review, particularly after private repositories were exposed in token-stealing supply chain incidents.
Organizations using the affected package should pin it to version 0.2.22 and review whether version 0.2.21 was installed or executed.
They should block the socket endpoint and delivery hostnames identified in the full research, while searching for artifacts left by the chain rather than only the self-deleting implant.
Teams should also audit release workflow changes, restrict main-branch write access, rotate exposed credentials, and preserve source-control logs.
No evidence in the report confirms that an organization was successfully compromised through the package. Still, the brief exposure illustrates a larger problem: withdrawing a malicious package version can stop new downloads without disabling attacker infrastructure or alerting every user who already obtained it.
Earlier software build file abuse shows why package integrity checks must be paired with monitoring of CI activity and developer accounts.
Indicators of compromise (IoCs):-
| Type | Indicator | Description |
|---|---|---|
| Malicious npm package version | @dforge-core/dforge-mcp@0.2.21 | Poisoned release that distributed the GHAPPIER remote code loader. |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC
Tushar is a senior cybersecurity and breach reporter. He specializes in covering cybersecurity news, trends, and emerging threats, data breaches, and malware attacks. With years of experience, he brings clarity and depth to complex security topics.