Hackers Compromise 65 GitHub Repositories and Poison npm Package With Hidden Backdoor

Threat actors have compromised at least 65 public GitHub repositories in a software supply-chain campaign that abused npm trusted publishing to distribute a stealthy backdoor through a legitimate package.

The malicious package was identified as @dforge-core/dforge-mcp, an MCP-related npm package whose maintainer account was abused for roughly 105 minutes on September 9.

Attackers initially pushed version 0.2.20, which broke package installation, before publishing version 0.2.21 containing the functional loader.

The poisoned version remained the package’s latest release for 35 minutes and 38 seconds before it was withdrawn.

Unlike conventional npm malware that executes during preinstall or postinstall, the GHAPPIER loader activated only when the MCP server was launched.

This delayed execution model reduced the likelihood of discovery during package installation, dependency scanning, or automated build validation.

Systems that downloaded the malicious version but never started the package did not execute the payload.

The campaign highlights a critical limitation in software provenance systems.

According to CloudSEK’s analysis, the attacker modified the package release workflow so pushes to the main branch automatically triggered publishing through GitHub Actions.

Fourteen minutes later, the workflow was further changed to enable unattended release activity using npm’s OIDC-based trusted publishing mechanism.

The resulting package carried a valid provenance attestation recorded in Sigstore’s transparency log.

However, the attestation only confirmed where and how the artifact was built, not whether the underlying source changes were legitimate.

In effect, the package was cryptographically verified as having been released from the compromised repository’s authorized CI/CD workflow.

“Provenance attests where an artefact was built, not whether its source was honest,” CloudSEK noted.

The incident illustrates how repository write access can become direct package-publishing access when release automation trusts any code pushed to a protected branch.

The hidden loader was embedded as a single line inside a 99 KB file and initiated a four-stage execution chain.

The final payload delivered a general-purpose remote shell that removed itself from disk while running, making forensic recovery more difficult.

Investigators traced GHAPPIER activity to at least 65 public GitHub repositories, 73 infected files, and 22 accounts.

A second payload discovered in another compromised repository was an exact match for PolinRider, a malware campaign previously tracked by OpenSourceMalware since March 2026.

CloudSEK Researchers said that, the operation, tracked as GHAPPIER, demonstrates that verified npm provenance can still be attached to malicious releases when attackers gain access to a maintainer’s source repository and CI/CD pipeline.

65 GitHub Repositories

PolinRider has been associated with credential harvesting activity, making stolen developer credentials a likely initial-access path.

CloudSEK could not confirm the exact compromise vector for the @dforge-core/dforge-mcp maintainer account, but assessed that a malicious browser extension or previously installed package may have infected the developer workstation.

The researchers found no evidence that GitHub, npm, or the package itself was directly exploited.

The PolinRider-linked component retrieved its configuration from an empty Ethereum transaction costing approximately $0.20.

This design removes the need for a conventional command-and-control domain or hosted configuration server, denying defenders an obvious domain to block, registrar to contact, or server to seize.

Some researchers have linked PolinRider activity to North Korean operators, but CloudSEK said its independent review did not validate that attribution.

The available evidence therefore supports a connection to the malware family, not a confirmed state-backed attribution.

Organizations should immediately identify lockfiles referencing @dforge-core/dforge-mcp version 0.2.21 and pin the dependency to version 0.2.22 or another verified-clean release.

CloudSEK recommended treating a lockfile entry for 0.2.21 as an indicator of potential exposure, even where no visible execution artifacts are present.

Microsoft recently documented a related Mini Shai-Hulud campaign that used compromised npm packages to steal GitHub, AWS, Vault, npm, Kubernetes, and 1Password credentials from Linux-based GitHub Actions environment.

Security teams should also audit GitHub Actions release workflows for unexpected changes to triggers, especially modifications that allow every main branch push to invoke package publishing.

In this incident, the workflow trigger was changed only 14 minutes before the altered automation was used to release the backdoored package.

The attack follows broader npm ecosystem compromises in which adversaries target CI/CD environments, GitHub Actions tokens, cloud credentials, npm publishing tokens, Kubernetes secrets, and developer tooling.

For maintainers, the immediate lesson is clear: trusted publishing and SLSA-style provenance remain valuable controls, but they cannot compensate for compromised source control, overly broad CI permissions, or unreviewed release-workflow changes.

Indicators of Compromise

Artefact	SHA-256
Carrier tarball 0.2.21	e9045b27557e5019fe44a1d5ae4b77714faa65fef883127ca7db85b7970afab4
skills/indexe.cjs	f2c8234c00b1f5b0b135534bf51207dc0239647890b73531996d60c90cf9e866
package.json 0.2.21	a85c6955ad689aa89eaae8c8b30723935274f069aed044489cfd922b46bcf2f7
Stage 1 dispatcher	c8337c06f4d3e79dd65aca4058b7a32c763468cdc7df76a849c55395d703a40d
Stage 2 Linux	50ed4f880d6d38ee26f410fc6bd9b734e4857b3a94ee6ef152e7e1158bd83153
Stage 2 macOS	bb36446376455c96b574567b7ee849657d8fe15ace897f460ad3fb867be9aafc
Stage 2 Windows	cc8502cb19ef30fe2ce68306e800bbb343e5da6799a57a91d1ebb4cb027029a5

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC