Hackers Compromise 65 GitHub Repositories and Poison npm Package With Hidden Backdoor
CloudSEK details GHAPPIER campaign compromising 65 GitHub repos to backdoor the @dforge-core/dforge-mcp npm package with cryptographically verified provenance.
The GHAPPIER operation compromised at least 65 GitHub repositories, 73 files and 22 accounts, using npm's OIDC trusted publishing via a modified GitHub Actions workflow to release a backdoored @dforge-core/dforge-mcp version 0.2.21 that carried a valid Sigstore provenance attestation. The loader activates only when the MCP server launches, running a four-stage chain that delivers a self-deleting remote shell, evading install-time and dependency scanning. A second payload exactly matches the PolinRider credential-stealing campaign, and its configuration is fetched via an empty Ethereum transaction to eliminate a blockable C2 domain.
- Verified npm provenance attached to malicious release from compromised maintainer repo
- Loader executes only on MCP server launch, dodging install-time malware checks
- 65 repositories, 73 infected files, and 22 accounts traced to GHAPPIER
- Second payload matches PolinRider credential stealer tracked since March 2026
- Configuration delivered via empty Ethereum transaction removes C2 domain to block
- ATT&CK
- T1195.002 Compromise Software Supply ChainT1078 Valid AccountsT1059 Command and Scripting Interpreter
- Organizations
- CloudSEKGHAPPIERPolinRiderGitHubnpm
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| sha256 | 50ed4f880d6d38ee26f410fc6bd9b734e4857b3a94ee6ef152e7e1158bd83153 | aca4058b7a32c763468cdc7df76a849c55395d703a40d Stage 2 Linux 50ed4f880d6d38ee26f410fc6bd9b734e4857b3a94ee6ef152e7e1158bd83153 Stage 2 macOS bb36446376455c96b574567b7ee849657d8fe15ace897 |
| sha256 | a85c6955ad689aa89eaae8c8b30723935274f069aed044489cfd922b46bcf2f7 | 51207dc0239647890b73531996d60c90cf9e866 package.json 0.2.21 a85c6955ad689aa89eaae8c8b30723935274f069aed044489cfd922b46bcf2f7 Stage 1 dispatcher c8337c06f4d3e79dd65aca4058b7a32c763468cd |
| sha256 | bb36446376455c96b574567b7ee849657d8fe15ace897f460ad3fb867be9aafc | 410fc6bd9b734e4857b3a94ee6ef152e7e1158bd83153 Stage 2 macOS bb36446376455c96b574567b7ee849657d8fe15ace897f460ad3fb867be9aafc Stage 2 Windows cc8502cb19ef30fe2ce68306e800bbb343e5da6799a |
| sha256 | c8337c06f4d3e79dd65aca4058b7a32c763468cdc7df76a849c55395d703a40d | b30723935274f069aed044489cfd922b46bcf2f7 Stage 1 dispatcher c8337c06f4d3e79dd65aca4058b7a32c763468cdc7df76a849c55395d703a40d Stage 2 Linux 50ed4f880d6d38ee26f410fc6bd9b734e4857b3a94ee6 |
| sha256 | cc8502cb19ef30fe2ce68306e800bbb343e5da6799a57a91d1ebb4cb027029a5 | 67b7ee849657d8fe15ace897f460ad3fb867be9aafc Stage 2 Windows cc8502cb19ef30fe2ce68306e800bbb343e5da6799a57a91d1ebb4cb027029a5 Note: IP addresses and domains are intentionally defanged ( |
| sha256 | e9045b27557e5019fe44a1d5ae4b77714faa65fef883127ca7db85b7970afab4 | ators of Compromise Artefact SHA-256 Carrier tarball 0.2.21 e9045b27557e5019fe44a1d5ae4b77714faa65fef883127ca7db85b7970afab4 skills/indexe.cjs f2c8234c00b1f5b0b135534bf51207dc023964789 |
| sha256 | f2c8234c00b1f5b0b135534bf51207dc0239647890b73531996d60c90cf9e866 | 5ae4b77714faa65fef883127ca7db85b7970afab4 skills/indexe.cjs f2c8234c00b1f5b0b135534bf51207dc0239647890b73531996d60c90cf9e866 package.json 0.2.21 a85c6955ad689aa89eaae8c8b30723935274f06 |
From the original article
4 min read at gbhackers.com
Threat actors have compromised at least 65 public GitHub repositories in a software supply-chain campaign that abused npm trusted publishing to distribute a stealthy backdoor through a legitimate package. The malicious package was identified as @dforge-core/dforge-mcp, an MCP-related npm package whose maintainer account was abused for roughly 105 minutes on September 9. Attackers initially pushed […]
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.