GHAPPIER npm Loader Compromised a Package Release; Researchers Link a Second Payload to PolinRider

Summary

Researchers analyzed a malicious npm release published through a compromised maintainer account and found a separate payload matching PolinRider’s documented method. They report no evidence of successful organizational compromise.

Key points

On September 9, 2026, an attacker used access to the maintainer account for @dforge-core/dforge-mcp to publish malicious version 0.2.21; the maintainer replaced it with clean version 0.2.22.
The attacker modified the repository’s GitHub Actions workflow so a push could publish the package unattended. Trusted publishing meant repository access was sufficient; no npm credential was needed.
The malicious release had valid npm provenance and a Sigstore attestation identifying the attacker’s commit. The researchers note that provenance records where an artifact was built, not whether its source was trustworthy.
The package included a four-stage loader whose final implant deletes itself when run. The researchers say the stages remained reachable five days after the malicious release was withdrawn.
A separate payload found in another repository matched PolinRider’s documented technique of appending a payload to a legitimate configuration file and retrieving command-and-control information from the Ethereum blockchain.
The researchers recommend blocking the identified socket endpoint and delivery hostnames, checking for artifacts left by the loader, and pinning the package at version 0.2.22.
The article reports no evidence that any organization was successfully compromised and says there was no advisory in OSV or GitHub’s database, or from the maintainer, warning users of version 0.2.21.

Article Details

Attack Vectors: An actor used a maintainer account with main-branch push access to modify the @dforge-core/dforge-mcp repository, change its release workflow, and publish a malicious release as version 0.2.21.
The article suspects, but cannot confirm, that developer access may have originated from a developer infected with a malicious extension or package.
The report says the PolinRider campaign harvests cached Git credentials from infected machines and uses them to push to repositories.
A payload appended to a project configuration file reads command-and-control configuration from the Ethereum blockchain.
Defensive Notes: Block the socket endpoint and the two delivery hostnames; the article does not provide their values.
Search for artifacts left by the loader chain rather than only for the final implant, which deletes itself from disk when it runs.
Pin @dforge-core/dforge-mcp at version 0.2.22.
The article says withdrawing version 0.2.21 did not make the remaining campaign infrastructure unreachable, and that no advisory was available in OSV, the GitHub database, or from the maintainer.