A newly identified supply chain attack has rocked the npm ecosystem. The threat, dubbed GHAPPIER Loader, emerged after attackers gained control of a legitimate maintainer account and leveraged npm’s trusted-publishing pipeline to slip a malicious package into @dforge-core/dforge-mcp, version 0.2.21. This campaign is tied to the DPRK-linked group known as PolinRider. Key aspects include abuse of GitHub Actions workflows, valid provenance attestations, multi-stage loaders, and evasive command-and-control techniques. Reported September 20, 2026.
What went down on September 9
On September 9, 2026, attackers held the maintainer credentials for the npm package @dforge-core/dforge-mcp for about 105 minutes. Within that interval they modified the project’s GitHub Actions workflow to trigger auto-publishing whenever any push hit the main branch. They then injected a remote-code loader—just one line added to the otherwise clean code—into the package. The malicious version 0.2.21 was published and remained available for precisely 35 minutes and 38 seconds. Shortly after, a clean release (version 0.2.22) was restored. Because the package was built via trusted publishing using OpenID Connect and carried a Sigstore attestation, it appeared authentic, despite harboring malicious content. Note: version 0.2.20 was also attempted but failed to function properly.
Inside the GHAPPIER loader
GHAPPIER operates as a four-stage loader. The chain begins with the injected code in the package source, then uses the rewritten CI workflow to force automatic, unchecked publishing. The malicious package then executes, followed by a final implant that self-deletes immediately upon execution, leaving virtually no artifact behind. Unusually, activation depends on starting the package’s server; simply installing version 0.2.21 without initating the server would not trigger the loader.
The command-and-control setup is especially stealthy: instead of using domain names or IP addresses, GHAPPIER pulls commands from transactions on the Ethereum blockchain. Operators embed commands or configuration data via a recipient address in otherwise empty, low-cost transactions—making traditional takedowns far harder.
PolinRider ties and scale
CloudSEK, the threat intelligence firm that disclosed the breach, found overlaps between GHAPPIER and PolinRider’s infrastructure. PolinRider, active since at least March 2026, has compromised hundreds of repositories across npm, PyPI, Go modules, Packagist, and Chrome Web Store. With GHAPPIER added to its arsenal, PolinRider has now been mapped across at least 65 public repositories and 22 developer accounts.
Why this matters
The incident exposes a troubling gap in current software supply chain security: trusted publishing mechanisms like CI/CD pipelines, OIDC, and provenance attestations can be co-opted if a developer environment or maintainer account is breached. Even though provenance attestation shows where a package was built, it does nothing to guarantee the integrity of the source under version control if access credentials have been compromised.
Mitigations and best practices
CloudSEK recommends urgent steps: upgrade all installations of @dforge-core/dforge-mcp to version 0.2.22 to avoid version 0.2.21; audit lock files and dependency trees for sneaky version pinning; rotate and revoke any leaked developer or CI secrets active during or after the 105-minute breach; and block known delivery endpoints tied to the attack once full indicators are published. Because the final stage deletes itself, defenders are urged to scan for indirect signals—rewritten workflows, injected loader lines, and blockchain RPC connections—instead of hunting for vanished files.
Longer term, organizations are encouraged to harden CI/CD setups: require branch protection and mandatory code review before any automated publishing via trusted workflows, treat provenance attestations as proof of build origin—not source integrity, and monitor developer environment egress, especially towards public blockchain RPC endpoints. Behavioral detection and SBOM tracking remain essential layers of defense.
What to watch: If GHAPPIER is detected in further npm packages, or if downstream compromises in major organizations emerge, this could mark a new phase in supply chain attacks—one where CI/CD pipelines and blockchain-based C2 become standard elements of stealth. Devs who assume trust in tools like OIDC, Sigstore, or GitHub Actions may need to rethink that trust in favor of zero trust and layered verification.
