SubQuery npm package (@subql/common) compromised with credential-stealing payload

What it is

StepSecurity's own platform controls mapped against the five-incident wave (Nx Console VS Code extension, actions-cool/issues-helper GitHub Action, Microsoft durabletask PyPI package, the Shai-Hulud npm worm, and GitHub's internal repo exfiltration). The summary covers the incidents and the general argument; what it omits is the specific detection mechanisms and the concrete remediation checklist the vendor lays out.

How it works

Each incident exploited a different pipeline layer, and each is countered by a specific control described at the mechanism level:

• Harden Runner — a runtime agent on GitHub Actions runners that monitors process behavior and enforces network egress allowlists. In block mode it drops connections to any non-allowlisted domain, stopping exfiltration even when a compromised Action (actions-cool) or the Shai-Hulud worm tries to read /proc/pid/mem and POST stolen secrets out.
• Compromised Actions Policy — a pre-execution gate: once StepSecurity's Threat Center flags a compromised Action, the policy auto-cancels any workflow run referencing it org-wide, closing the gap between disclosure and individual teams patching workflow files.
• Dev Machine Guard — inventories IDE extensions and installed npm/Python packages on developer laptops, letting a team instantly search whether an affected Nx Console version or a Shai-Hulud-targeted package is present — the layer that caught the vector that breached GitHub itself.
• Secure Registry (Beta) — a proxy in front of npm/PyPI that enforces a cooldown period on freshly published versions, directly addressing the durabletask case where the malicious version was pulled within a 35-minute window of publication.
• Package Search — scans default branches and open PRs for known-compromised package versions in lockfiles/manifests.
• GitHub Checks — per-PR cooldown verification, pwn-request detection, and script-injection analysis.

Preconditions / Affected

Applies to orgs using GitHub Actions, npm/PyPI dependencies, and developer IDE extensions — i.e., essentially any modern CI/CD pipeline. Secure Registry specifically requires using JFrog or Google Artifact Registry as the upstream proxy target. Harden Runner's block mode (vs. audit mode) is what actually stops exfiltration; audit mode only flags it.

What to do

For existing StepSecurity customers, the post gives a six-item checklist:

1. Confirm Threat Center notification channels are active.
2. Ensure Dev Machine Guard coverage across all developer machines.
3. Enable Compromised Actions Policy for automatic org-wide workflow blocking.
4. Deploy Harden Runner on Actions workflows; switch sensitive workflows from audit to block mode.
5. If on JFrog/Google Artifact Registry, configure Secure Registry as npm upstream with a cooldown policy.
6. Enable GitHub Checks for cooldown enforcement, pwn-request detection, and script-injection analysis.

For non-customers: Harden Runner and Dev Machine Guard both have free tiers (Harden Runner free for open-source repos).

Caveats

This is vendor content: every named control is a StepSecurity product, and the "matrix" referenced (which control catches which incident) is described but not reproduced in the fetched text. No independent verification of detection claims is given — effectiveness figures (e.g., "minutes" between IOC discovery and automated blocking) are StepSecurity's own characterization.