GHAPPIER Supply Chain Attack Compromises 65 GitHub Repositories and Poisons npm Package

A newly uncovered software supply chain attack has shown how quickly a trusted developer account can become a delivery route for malware.

The operation, tracked as GHAPPIER, reached 65 GitHub repositories, infecting 73 files across 22 accounts. It involved a legitimate npm package that distributed a malicious loader to users.

Attackers used access to a package maintainer account to alter source code and automate publication from the project’s main branch.

The poisoned release appeared legitimate because it was built through the project’s automated publishing process. That made a routine dependency update capable of carrying a remote code loader into developer environments.

CloudSEK said in a report shared with Cyber Security News (CSN) that the incident began on September 9, when an intruder used the maintainer account of @dforge-core/dforge-mcp for 105 minutes.

The researchers could not confirm how access was obtained, but said an infected developer machine, extension, or package was a plausible route to the credentials.

The case matters beyond the npm release. It highlights why trusted publishing, source control access, and developer devices belong to the same security boundary.

Malicious GitHub workflow campaigns show how attackers can turn automation into a route for credential theft and wider repository compromise.

GHAPPIER Supply Chain Attack

During the intrusion, the threat actor inserted a remote loader, changed three lines so pushes to the main branch would start a release workflow, then rewrote that workflow for unattended publication.

The malicious @dforge-core/dforge-mcp version 0.2.21 remained the latest registry release for 35 minutes and 38 seconds before the maintainer restored the project and released clean version 0.2.22.

The altered package carried valid npm provenance. GitHub Actions created it using OpenID Connect trusted publishing, and its attestation in Sigstore recorded the attacker’s commit.

The record could not show that code entering the build was safe. Write access to the repository became publishing access, a risk also seen when npm packages are compromised at scale.

The loader was hidden in one line near line 3,320 of a 99 KB file and started a four-stage chain. Its final component deleted itself, reducing the chance that a disk search would find the implant. The researchers said all stages still responded when tested five days after the package was withdrawn.

Hidden Delivery Chain Raises Response Risks

CloudSEK’s wider review connected a second payload family in another victim repository to PolinRider, a documented campaign that silently appends code to real project configuration files.

The payload reads command-and-control information from an Ethereum blockchain transaction rather than using a normal domain or host. The report noted that an exact match was still beaconing when the research was written.

The researchers said the observed pattern may explain the initial account takeover. PolinRider has been documented harvesting cached Git credentials from infected machines, allowing an attacker to push code under a developer’s identity.

That possibility illustrates why developer endpoint protection matters as much as repository review, particularly after private repositories were exposed in token-stealing supply chain incidents.

Organizations using the affected package should pin it to version 0.2.22 and review whether version 0.2.21 was installed or executed.

They should block the socket endpoint and delivery hostnames identified in the full research, while searching for artifacts left by the chain rather than only the self-deleting implant.

Teams should also audit release workflow changes, restrict main-branch write access, rotate exposed credentials, and preserve source-control logs.

No evidence in the report confirms that an organization was successfully compromised through the package. Still, the brief exposure illustrates a larger problem: withdrawing a malicious package version can stop new downloads without disabling attacker infrastructure or alerting every user who already obtained it.

Earlier software build file abuse shows why package integrity checks must be paired with monitoring of CI activity and developer accounts.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC

The post GHAPPIER Supply Chain Attack Compromises 65 GitHub Repositories and Poisons npm Package appeared first on Cyber Security News.