Attackers Abuse npm Trusted Publishing in GHAPPIER Campaign
Attackers abused npm trusted publishing to ship the GHAPPIER loader via a legitimate package in the North Korea-linked PolinRider campaign.
Attackers compromised the npm package @dforge-core/dforge-mcp, using trusted publishing to release a malicious version (0.2.21) with valid provenance on September 9. The release contained the GHAPPIER loader, which opened a four-stage chain ending in a remote shell that deleted itself. The campaign is linked to PolinRider, attributed to North Korea, which uses cryptocurrency transactions for C2 configuration to evade infrastructure takedowns.
- Attackers abused npm trusted publishing to push malicious package 0.2.21 with valid provenance.
- Loader GHAPPIER launched a remote shell and deleted itself from disk during MCP server startup.
- Campaign linked to PolinRider, a North Korea-attributed credential harvesting operation.
- ATT&CK
- T1195.002 Supply Chain Compromise: Compromise Software Supply ChainT1059.006 Command and Scripting Interpreter: Python
- Vendors
- CloudSEK
- Threat actors
- PolinRider
- Malware
- GHAPPIERPolinRider
- Organizations
- CloudSEKnpmGitHubNorth Korea
From the original article
2 min read at infosecurity-magazine.com
CloudSEK linked GHAPPIER to a compromised npm package with valid trusted-publishing provenance
By Alessandro Mascellino · infosecurity-magazine.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.