npm Supply-Chain Attack Abuses Trusted Publishing to Ship GHAPPIER Loader

What it is

An active npm supply-chain attack on @dforge-core/dforge-mcp, shipping the GHAPPIER remote-shell loader as version 0.2.21 with valid Sigstore/GitHub OIDC provenance. No CVE and no advisory exists in OSV, the GitHub Advisory Database, or from the maintainer. The summary has the shape; the page carries the version boundaries, the compromise timeline, and the concrete IoCs/remediation an engineer needs to act.

How it works

On September 9, 2026 attackers compromised the maintainer account and edited the GitHub Actions release workflow so any push to main triggered an OIDC trusted publish — converting push access into publish access. The malicious code was a single line hidden at line 3320 of a 99KB configuration file. The four-stage payload activates only when the MCP server launches (not at npm install); the final implant opens a general-purpose remote shell, then deletes itself from disk, leaving no file-based trace.

The second payload (PolinRider, DPRK-linked, tracked since March 2026) writes C2 config into the 20 bytes of a recipient address on empty Ethereum transactions — no domain to suspend, no host to seize.

Preconditions / Affected

• @dforge-core/dforge-mcp 0.2.21 — the malicious release; latest for ~35 minutes before clean 0.2.22 was published.
• 0.2.20 — an earlier malicious attempt that failed and broke installation.
• Both published inside a 105-minute compromise window.
• Matters only where the MCP server was actually launched (execution, not install, triggers the chain).

What to do

• Pin @dforge-core/dforge-mcp to 0.2.22 or later.
• Treat any lockfile pinning 0.2.21 as an indicator of potential compromise.
• Search for intermediate artifacts left by the four-stage chain — the final implant self-deletes, so hunting the implant itself will miss it.
• Block the socket endpoint and two delivery hostnames named in the CloudSEK report.
• Monitor GitHub Actions configs for release-workflow trigger modifications.
• Audit whether any CI/CD system executed 0.2.21, and rotate credentials on any host where it ran.

Caveats

Detection is limited: because the implant leaves no disk trace, verification depends on intermediate artifacts and lockfile evidence rather than the payload. SCA tooling will not flag 0.2.21 until an advisory is published — until then this is a manual lockfile check. Reach across repos (65 repos / 73 files / 22 accounts) is CloudSEK's tracing, not the maintainer's or a CVE authority's.