StepSecurity Reports Credential-Stealing Backdoor in @subql/common 5.8.3
Summary
StepSecurity reports that @subql/[email protected] contains a payload that runs on install or import, collects credentials, and supports exfiltration and remote commands via ci-artifacts[.]dev. Its analysis found no evidence of execution on victim systems.
Key points
- StepSecurity says it verified the published @subql/[email protected] tarball against npm metadata and found added manifest-cache files and modified package code.
- The release workflow replaced the built package with an archive fetched from ci-artifacts[.]dev without hash or signature verification in that step.
- The payload can start during installation or package import; disabling install scripts alone would not prevent the import-time trigger.
- Static analysis found collectors targeting local credential files, process environment data, Linux GitHub Actions runner memory, and accessible AWS, Kubernetes, and Vault secrets; access depends on permissions and environment.
- The recovered payload includes an attempted GitHub Actions workflow for collecting repository secrets, encrypted data exfiltration, and remote command and shell functionality. StepSecurity reports no observed victim execution.
- StepSecurity’s snapshot review found 19 of 77 examined latest @subql package versions with potential dependency paths to 5.8.3; it recommends excluding the version, investigating possible execution, and revoking exposed credentials.
Article Details
- Attack Vectors
- The compromised @subql/[email protected] npm release contains a hidden JavaScript payload that starts during installation and when the package is imported; the import path can start a detached worker.
- A modified release workflow downloads an external archive from ci-artifacts.dev and replaces the built package immediately before publishing, without hash or signature verification in the added step.
- The payload collects readable credential and configuration files, process environment data, GitHub tokens, and—under stated Linux GitHub Actions runner conditions—attempts to read Runner.Worker memory.
- With a collected GitHub token meeting the payload's scope and access checks, it attempts to add a branch and workflow that serializes accessible Actions secrets into an artifact.
- The payload encrypts collected data for submission to its remote endpoint and polls for commands; shell instructions attempt to connect a local shell or PTY.
- Defensive Notes
- Treat @subql/[email protected] as unsafe and prevent its installation and import, including through transitive dependency resolution and lockfiles; disabling install scripts alone is insufficient.
- Block ci-artifacts.dev and investigate systems where version 5.8.3 was installed or imported. Hunt for the loader, PID lock, injected branch and workflow, and related artifacts.
- If the payload could have run, isolate affected hosts and runners, preserve process and network evidence, rebuild from trusted images, and revoke and rotate credentials available to the process.
- Review GitHub Actions creation and deletion events, exposed repositories, and cloud secret access logs. Correlate package presence with execution and network telemetry; uninstalling alone does not stop a detached worker.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | ci-artifacts[.]dev | Identified malicious infrastructure used for artifact delivery, data exfiltration, and remote commands. |
| SHA256 | 031267ee37c5a84c25cb0542cbfeb49f30d5604305b0bdccdeafbedcbbe6849b | SHA-256 of the investigated common-5.8.3.tgz package artifact containing the payload. |
| SHA256 | 7b2807bfb5bfec2383b46ba8226f47edb330ae6b32178eab61e377f3c3486c47 | SHA-256 of the decoded first-stage JavaScript payload. |
| SHA256 | f0c8b0cde86b98a2869a22fd43ffcf61f1dcca252729e2be291e590e3dc5f49a | SHA-256 of the manifest-cache.js loader in the malicious package. |
| URL | hxxps[:]//ci-artifacts[.]dev/pkg/@subql-common-5.8.3.tgz | External archive URL added to the release workflow to substitute package artifacts before publication. |
| URL | hxxps[:]//ci-artifacts[.]dev/router | Payload endpoint used for encrypted collection uploads and command check-ins. |
MITRE ATT&CK
T1005 · Data from Local SystemThe payload collects local file contents, process environment data, and accessible runner process memory.T1036.005 · Match Legitimate Resource Name or LocationThe injected workflow and branch use names resembling routine developer or security activity, including CodeQL Analysis and a dependabot-style branch.T1041 · Exfiltration Over C2 ChannelIt compresses and encrypts collected data and submits it to the remote endpoint.T1059.004 · Unix ShellThe command channel can start a local shell or PTY to execute returned shell instructions.T1059.006 · PythonOn qualifying Linux GitHub Actions runners, the payload invokes sudo python3 to inspect Runner.Worker memory.T1059.007 · JavaScriptThe package decodes JavaScript and executes it through a Function constructor in a detached worker.T1071.001 · Web ProtocolsThe payload uses HTTP(S) requests to check in, receive commands, and communicate with its /router endpoint.T1105 · Ingress Tool TransferThe modified publishing workflow downloads an external package archive from ci-artifacts.dev before publication.T1195.002 · Compromise Software Supply ChainA payload-bearing @subql/[email protected] release was published through a workflow that substituted an external archive for the built package.T1528 · Steal Application Access TokenThe payload tries gh auth token and collects GitHub token-shaped values for its workflow-injection logic.T1550.001 · Application Access TokenIt attempts to use collected GitHub tokens to enumerate accessible repositories and create a workflow.T1552.001 · Credentials In FilesIt reads credential and configuration files such as .npmrc, .env, AWS credentials, kubeconfig, and cloud caches.T1552.004 · Private KeysSSH keys are among the local files targeted for collection.T1552.005 · Cloud Instance Metadata APIThe AWS credential collection paths attempt to obtain credentials through EC2 IMDSv2.T1560.001 · Archive via UtilityCollected results are compressed with gzip before encryption and transmission.
People
Vendors
GitHuband when the package is imported. The code targets developer workstations and CI environments, including GitHub Actions runners and accessible cloud services.npmOn October 5, 2026, StepSecurity’s AI Package Analyst flagged @subql/[email protected] as a suspicious npm release. View the finding in the StepSecurity OSS Security Feed.StepSecurityOn October 5, 2026, StepSecurity’s AI Package Analyst flagged @subql/[email protected] as a suspicious npm release. View the finding in the StepSecurity OSS Security Feed.SubQueryWe have opened GitHub issue #3047 in the SubQuery repository to report these findings and request a maintainer investigation.
Products
@subql/commonOn October 5, 2026, StepSecurity’s AI Package Analyst flagged @subql/[email protected] as a suspicious npm release. View the finding in the StepSecurity OSS Security Feed.Dev Machine GuardStepSecurity Dev Machine Guard inventories packages on enrolled developer devices and exposes their versions and installation locations. Search for @subql/common version 5.8.3, including copies installed through otherGitHub Actionswhen the package is imported. The code targets developer workstations and CI environments, including GitHub Actions runners and accessible cloud services.Harden-RunnerHarden-Runner provides network and process visibility during supported CI/CD runs, helping teams investigate suspicious activity and correlate outbound connections with the responsible workflow step.SubQueryWe have opened GitHub issue #3047 in the SubQuery repository to report these findings and request a maintainer investigation.