ATTACKERS abused npm’s trusted publishing system in a supply-chain attack that inserted a previously unreported loader, named GHAPPIER, into the legitimate `@dforge-core/dforge-mcp` package. CloudSEK reported that the maintainer account was used for 105 minutes on 9 September 2026. Malicious release 0.2.20 disrupted installation, while version 0.2.21 successfully delivered the loader and remained the latest release for 35 minutes and 38 seconds.
The attacker already had access to the repository’s main branch, although CloudSEK could not establish how that access was obtained and suspected an infected developer machine.
The attacker altered three lines to trigger the release workflow on every push, then modified the workflow 14 minutes later so it could publish without supervision. The release was built through GitHub Actions using OIDC trusted publishing, giving it valid Sigstore provenance and allowing it to pass npm’s signature checks. However, provenance confirmed where the package was built, not that its source was trustworthy.
The loader, hidden as one line in a 99KB file, launched when the MCP server started—not during installation—and began a four-stage chain ending in a self-deleting remote shell.
CloudSEK found the activity across at least 65 public repositories, 73 infected files and 22 accounts, but no evidence that an organisation was successfully compromised. A related payload matched PolinRider, although its reported North Korean attribution remains unconfirmed. CloudSEK advised pinning the package to 0.2.22, treating lockfiles specifying 0.2.21 as indicators, searching for the chain’s artefacts and monitoring release-workflow trigger changes.