CloudSEK: npm Trusted Publishing Abused to Ship GHAPPIER Loader

September 21, 2026 at 06:30 PM2 min

This digest was compiled by AI from multiple sources — links to the originals are below.

Attackers abused npm trusted publishing to ship a previously unreported loader, GHAPPIER, in a legitimate package with valid provenance, CloudSEK reported on September 20. The malicious release 0.2.21 stayed live for 35 minutes and 38 seconds on September 9. CloudSEK found no exploitation of GitHub, npm, or any package, attributing the incident to a stolen maintainer key.

Key Facts

CloudSEK reported on September 20 that the maintainer account of @dforge-core/dforge-mcp was used for 105 minutes on September 9.
Malicious release 0.2.21 shipped the GHAPPIER loader and remained the latest version for 35 minutes and 38 seconds.
The attacker changed three lines to trigger the release workflow on any push to the main branch, then rewrote the workflow 14 minutes later for unattended publishing.
CloudSEK traced GHAPPIER across at least 65 public repositories, 73 infected files, and 22 accounts.
A second payload in another victim's repository exactly matched PolinRider, a campaign tracked by OpenSourceMalware since March 2026.

Attack Mechanics

The attacker used the maintainer account of @dforge-core/dforge-mcp for 105 minutes on September 9. A first malicious release, 0.2.20, failed and broke installation of the package. Release 0.2.21 then shipped the loader and stayed the latest version for 35 minutes and 38 seconds. The attacker changed three lines so any push to the main branch started the release workflow, then rewrote the workflow 14 minutes later so it could publish unattended. The build ran through GitHub Actions with OIDC trusted publishing, and its attestation is still in Sigstore's public log, naming the attacker's commit.

Payload and Delivery

The loader was one line in a 99KB file, opening a four-stage chain that ended in a general-purpose remote shell which deleted itself from disk as it ran. It fired when the MCP server was launched rather than on install, so systems that installed 0.2.21 without starting it did not run the loader. CloudSEK found no exploitation of GitHub, npm or any package, stating every action in the report was an authorised action taken with a stolen key.

PolinRider Link

CloudSEK traced GHAPPIER across at least 65 public repositories, 73 infected files and 22 accounts. A second payload in another victim's repository exactly matched PolinRider, a campaign OpenSourceMalware has tracked since March 2026. That payload read its configuration from an empty Ethereum transaction costing about $0.20, leaving no domain to suspend or host to seize. Other researchers attribute PolinRider to North Korea, but CloudSEK said its one independent check did not confirm it. CloudSEK said PolinRider's documented credential harvesting is the likeliest route into the maintainer account, and found no evidence of a successful compromise of any organization.