🧰 @subql/common

The items that name it 3

• David Gutierrez | Eng (@david_x_ai) on X
  threadas classification.key entities2026-10-26
• SubQuery Ecosystem Compromise: Hidden Credential Theft and Backdoors
  writeupas affected products2026-10-05

  npm package, shared library in the SubQuery monorepo (a Web3 data indexing framework); flagged as a suspicious release on October 5, 2026 containing a hidden credential-theft and backdoor payload triggered on install and import.

• SubQuery npm package (@subql/common) compromised with credential-stealing payload
  articleas affected productsIt is written here as @subql/common (npm package).

  SubQuery npm package named in the page title as compromised with a credential-stealing payload; not otherwise described in the body text.