npm Supply-Chain Attack Abuses Trusted Publishing to Ship GHAPPIER Loader

A high-severity supply-chain attack targeted the npm package @dforge-core/dforge-mcp, enabling attackers to distribute a remote-shell implant using legitimate npm provenance signatures. The exploitation occurred when attackers compromised the maintainer account and modified the GitHub Actions release workflow to allow pushes to trigger automated releases via OIDC trusted publishing. The malicious component, the GHAPPIER loader, was included in version 0.2.21, which carried valid provenance attestations recorded in Sigstore.
The exploit chain involved a four-stage payload that activated only upon launching the MCP server, resulting in the establishment of a remote shell and subsequent self-deletion to avoid forensic detection. This activity was traced across numerous repositories and involved coordination with broader campaigns utilizing blockchain transactions for command-and-control. The vulnerability is specific to version 0.2.21 of the package; version 0.2.20 was also part of a malicious attempt that failed during installation.
Organizations using this package must immediately pin dependencies to version 0.2.22 or newer and investigate any systems where version 0.2.21 was executed. Remediation involves blocking identified network endpoints, auditing CI/CD modifications, and rotating credentials on affected systems. Although no formal CVE exists, the sophisticated nature of the attack suggests a significant risk of full system compromise if exploited.

* The attack targeted the npm package @dforge-core/dforge-mcp version 0.2.21.
* Attackers compromised the maintainer account and modified the GitHub Actions release workflow on September 9, 2026.
* The modification allowed pushes to trigger automated releases through OIDC trusted publishing.
* The GHAPPIER loader was shipped as version 0.2.21, hidden in a configuration file.
* The malicious line was located at line 3320 of a 99KB configuration file.
* The release carried valid provenance through GitHub Actions OIDC and Sigstore logs.
* A four-stage payload activated only when the MCP server was launched.
* The final implant established a remote shell and deleted itself upon execution, leaving no file-based forensic trace.
* A second payload matched the PolinRider campaign, using Ethereum blockchain transactions for C2 configuration.
* CloudSEK traced the loader across 65 public repositories, 73 infected files, and 22 accounts.
* Affected versions were 0.2.21 (malicious) and 0.2.20 (failed malicious attempt).

The narrative here pivots on the breakdown of trust within automated supply chain mechanisms. The core manipulation lies in leveraging verifiable signatures—like those provided by GitHub Actions OIDC and Sigstore—to camouflage malicious code delivery. Attackers did not rely on breaking the cryptographic signature, but rather exploiting the *definition* of what the signature attests to: build origin, not source integrity. This reflects a systemic vulnerability where technical verifiability is decoupled from security assurance.
The pattern observed is the weaponization of legitimate automation infrastructure (GitHub Actions) and cryptographic attestations to create an illusion of legitimate provenance, which serves as a sophisticated form of social engineering against automated gatekeepers. The use of blockchain for C2 configuration demonstrates an attempt to achieve resilience against centralized takedown, layering decentralized coordination onto established vulnerability exploits.
The implication is that traditional security boundaries—between build systems and artifact distribution—are porous when relying solely on provenance markers without verifying the holistic context of development. The focus shifts from securing the package itself to securing the *process* that vouches for the package. This suggests a necessary evolution in defense towards validating the entire lifecycle, rather than just inspecting the final artifact or its signatures.
Bridge Questions: If trust in build provenance is inherently flawed, what alternative, non-relying-on-the-chain mechanisms can be established to guarantee build integrity? How should organizations re-evaluate the separation of duties between maintainers, automated systems, and release controls to mitigate this type of internal compromise? What systemic changes are needed to ensure that retrospective analysis, such as tracing a payload through blockchain transactions, becomes an inherent, low-friction part of dependency risk management?