CloudSEK researchers reported on September 20 that an attacker compromised the maintainer account for @dforge-core/dforge-mcp. The breach occurred on September 9 and lasted 105 minutes, a window during which two malicious releases were pushed. The first, version 0.2.20, failed installation. Version 0.2.21 succeeded, delivering the GHAPPIER loader and remaining the latest version on the registry for over 35 minutes before detection.
A Stolen Key, Not a Broken System
The attacker gained push access to the main branch, which CloudSEK suspects came from a developer machine compromised by a malicious extension or package. From there, the attacker modified the release workflow to publish unattended, leveraging GitHub Actions with OIDC trusted publishing.
The build’s attestation was logged in Sigstore, correctly naming the attacker’s own commit. Provenance attests where an artefact was built, not whether its source was honest,
CloudSEK noted in its report. The npm registry trusted the repository’s CI identity by design, so push access alone granted publish access, sidestepping npm audit signatures entirely.
How the Loader Actually Worked
The GHAPPIER loader itself was a single line buried in a 99KB file, but it triggered a four stage infection chain that ended in a general-purpose remote shell. That shell deleted itself immediately after execution.
The activation condition matters here. The loader only ran when the MCP server launched, not simply when the package was installed. Systems that pulled version 0.2.21 without ever starting that server were never infected.
CloudSEK found no exploitation of GitHub, npm, or any underlying package vulnerability. Every action in this report is an authorised action taken with a stolen key,
the report stated, underscoring that the entire chain relied on legitimate credentials rather than a technical flaw.
A Trail Leading to PolinRider
CloudSEK traced GHAPPIER across 65 public repositories, 73 infected files, and 22 accounts. A secondary payload found in another victim’s repository mirrored PolinRider, a campaign OpenSourceMalware has tracked since March 2026.
PolinRider’s command and control method is notably cheap and hard to shut down. It runs through an empty Ethereum transaction costing roughly $0.20, leaving no domain or hosting infrastructure for defenders to seize. Some researchers have linked PolinRider to North Korea, though CloudSEK’s own checks did not confirm that attribution. PolinRider’s credential harvesting is considered a likely route for how the original maintainer account was compromised in the first place.
Where Things Stand for Developers
As of CloudSEK’s report, no official advisory has appeared in either OSV or the GitHub database, and the package maintainer had not issued a public notice.
- Pin the package at version 0.2.22 or later
- Treat any lockfile referencing 0.2.21 as an immediate indicator of compromise
- Sweep for chain artifacts across the infection stages, not just the final implant
- Alert on any change to a release workflow’s trigger block, since one occurred just 14 minutes before the malicious workflow published in this incident
Hashlytics Take
Provenance attestation was supposed to answer the question “can I trust this package.” What this incident shows is that it only answers “was this built where it claims to have been built.” Those are different questions, and the gap between them is exactly where GHAPPIER lived. If your security posture treats a green provenance badge as equivalent to a verified maintainer, this is the incident that should change that assumption.
Follow Hashlytics on Bluesky, Facebook, LinkedIn , Telegram and X to Get Instant Updates