Subverting Supply Chain Provenance: Attackers Weaponize npm Trusted Publishing to Distribute GHAPPIER Loader with Immutable Ethereum C2
Date: September 22, 2026
Author: Threat Research & Intelligence Team, Digital Spying
Category: Supply Chain Security / Web & Cloud Security / Malware Analysis
Tags: npm, Supply Chain, Trusted Publishing, OIDC, GitHub Actions, GHAPPIER, PolinRider, Blockchain C2
Executive Summary
The open-source software supply chain has crossed a dangerous new threshold. On September 20–21, 2026, threat researchers at CloudSEK and Infosecurity Magazine disclosed an advanced supply-chain campaign in which adversaries successfully subverted npm Trusted Publishing—the security mechanism championed across the JavaScript ecosystem to eradicate static token theft through OpenID Connect (OIDC) authentication.
By compromising developer credentials and infiltrating the repository of @dforge-core/dforge-mcp (alongside an intrusion cluster spanning at least 65 public repositories and 22 developer accounts), the threat actors manipulated a GitHub Actions release workflow just 14 minutes prior to deployment. As a result, npm's automated CI/CD pipeline built, cryptographically signed, and published a malicious package release (v0.2.21) carrying valid, unassailable cryptographic provenance directly onto the official npm registry.
Embedded within this legitimate, verified release was GHAPPIER, a previously undocumented multi-stage loader designed to conduct in-depth environment fingerprinting, neutralize local telemetry, and fetch secondary payloads. Further analysis revealed that the secondary payload aligns with the PolinRider threat cluster, weaponizing an immutable, censorship-resistant dead-drop resolver: reading its command-and-control (C2) configuration directly from the data field of an empty Ethereum transaction costing just $0.20 USD.
This campaign exposes a critical industry fallacy: provenance does not equal benignity. When an attacker compromises the upstream source repository, automated cryptographic signing becomes an unwitting accomplice to malware distribution.
Technical Deep-Dive: Anatomy of the Trusted Publishing Subversion
To understand why this attack represents an inflection point in supply chain security, we must first examine how npm Trusted Publishing functions and where its trust assumptions collapse.
1. The Promise of npm Trusted Publishing
Historically, publishing packages to npm required generating static, long-lived automation tokens stored as repository secrets (e.g., NPM_TOKEN). Threat actors routinely harvested these tokens via compromised developer machines, CI/CD misconfigurations, or leaked build logs.
To eliminate static credentials, npm introduced Trusted Publishing, leveraging OIDC federation between GitHub Actions and the npm registry:
1. When a release workflow triggers, the GitHub Actions runner requests a short-lived OIDC JSON Web Token (JWT) from GitHub's token authority (token.actions.githubusercontent.com).
2. The runner presents this JWT to npm (registry.npmjs.org).
3. npm validates the JWT claims—verifying the repository owner, repository name, workflow filename, and target environment against pre-configured trust relationships.
4. If verified, npm issues an ephemeral publishing token valid for only a few minutes.
5. npm signs the package build using Sigstore infrastructure, generating cryptographic attestations (SLSA provenance) that consumers can verify.
2. Upstream Infiltration: The 105-Minute Window
According to CloudSEK’s forensic timeline, the attacker gained unauthorized commit access to @dforge-core/dforge-mcp on September 9, 2026. The initial compromise vector is suspected to be a developer endpoint infected via malicious IDE extensions or credential-stealing packages.
During a 105-minute window:
* Initial Test Failure: The attacker initially attempted to deploy version 0.2.20. However, a syntax error caused package installation to break, alerting automated checks.
* Workflow Adjustment: Exactly 14 minutes before successful publication, the attacker modified the .github/workflows/release.yml file, altering the workflow dispatch trigger and ensuring payload bundling during the automated build step.
* Successful Deployment: Version 0.2.21 was successfully built and published via the GitHub Actions runner, carrying valid Sigstore provenance attestations.
* Exposure Window: Version 0.2.21 remained the active, latest release on the npm registry for 35 minutes and 38 seconds before containment actions were initiated.
Malware Analysis: The GHAPPIER Loader
The core payload injected into dforge-mcp is GHAPPIER, a lightweight, modular Node.js loader engineered to avoid static detection heuristics.
1. Execution & Evasion
GHAPPIER hooks into standard module initialization routines. Upon invocation in a client environment:
* Anti-Analysis & Sandbox Probing: It inspects environment variables (CI, GITHUB_ACTIONS, TRAVIS, SANDBOX, VBOX) to confirm it is not running in an automated security testing harness.
* Process Enumeration: It executes lightweight system queries to verify the absence of monitoring agents and packet capture tools.
* Memory-Only Staging: It avoids writing intermediate binary artifacts to disk, operating entirely within the Node.js V8 heap.
2. The PolinRider Connection & Immutable Ethereum C2
When environment checks pass, GHAPPIER activates its second-stage resolver. Researchers discovered that GHAPPIER shares identical payload architecture with PolinRider, an operation tracked since early 2026.
Rather than reaching out to traditional domain names or dynamic DNS servers—which can be seized by law enforcement or sinkholed by security vendors—PolinRider leverages the Ethereum blockchain as an unseizable dead-drop resolver:// Pseudocode reconstruction of PolinRider Ethereum C2 resolver
const { ethers } = require("ethers");
const provider = new ethers.providers.JsonRpcProvider("https://cloudflare-eth.com");
async function resolveC2() {
const txHash = "0x8f3c71a9b4e2d5c8...[REDACTED_TX_HASH]";
const tx = await provider.getTransaction(txHash);
// Extract arbitrary payload embedded in the input data field
const rawData = tx.data; // Hex-encoded payload
const decryptedConfig = decryptPayload(rawData, HARDCODED_AES_KEY);
return JSON.parse(decryptedConfig).c2_endpoint;
}
Why Blockchain Dead-Drops Defeat Traditional Takedowns
* Cost: Publishing an empty Ethereum transaction with an encrypted configuration string in the data field costs the adversary approximately $0.20 USD in gas fees.
* Immutability: Once written to a block, transaction data can never be edited, deleted, or removed by any authority or cloud provider.
* Censorship Resistance: The malware uses standard, publicly accessible JSON-RPC gateways (such as Cloudflare Ethereum Gateway, Infura, or public nodes). Blocking these endpoints would break legitimate enterprise Web3 applications.
Why Modern Security Controls Failed
Security Mechanism
Intended Purpose
Failure Point in GHAPPIER Attack
npm Trusted Publishing (OIDC)
Prevent credential theft and ensure code originates from authorized repositories.
The adversary compromised the repository itself. The automated pipeline executed legitimately on behalf of the attacker.
SLSA Provenance / Sigstore
Provide verifiable cryptographic proof of build origin.
Generated a valid, authentic cryptographic signature for a malicious binary.
Domain Reputation / Sinkholing
Block network traffic to malicious C2 infrastructure.
The malware queried public Ethereum RPC infrastructure (cloudflare-eth.com), which maintains high enterprise trust.
Industry Impact & Threat Assessment
1. The "Verified Malware" Paradigm: Organizations relying on Software Bill of Materials (SBOM) and SLSA compliance policies that automatically whitelist packages with valid provenance would have accepted this malicious package without inspection.
2. Expansion Across the Ecosystem: CloudSEK identified indicators connecting GHAPPIER and PolinRider tradecraft across 65 public repositories and 22 developer accounts, demonstrating systematic targeting of open-source maintainers.
3. Targeting Model Context Protocol (MCP) Implementations: The targeted package (@dforge-core/dforge-mcp) is designed for MCP tooling—a framework connecting AI models to local tools and system resources—highlighting growing threat actor interest in AI infrastructure supply chains.
Actionable Recommendations & Hardening Strategies
For Open-Source Maintainers & Engineering Teams
1. Implement Multi-Review Branch Protection on Workflow Files:
* Configure strict GitHub branch protection rules requiring at least two independent administrative code reviews for any pull request or commit modifying files within .github/workflows/.
* Prevent repository administrators from bypassing branch rules.
2. Restrict Workflow Permissions (Principle of Least Privilege):
* Explicitly define minimal token permissions in GitHub Actions YAML definitions:permissions:
contents: read
id-token: write # Required strictly for OIDC
* Never grant broad write-all permissions to automated workflow jobs.
3. Implement Developer Endpoint Protection & Extension Auditing:
* Enforce hardware-backed multi-factor authentication (FIDO2 / WebAuthn) for GitHub accounts.
* Audit and restrict IDE extensions in Visual Studio Code and JetBrains environments, disallowing unverified third-party marketplace plugins.
For Enterprise Consumers & Security Operations (SOC)
1. Lockfile Enforcement & Pinning:
* Enforce deterministic dependency resolution via npm ci or pnpm install --frozen-lockfile.
* Ensure @dforge-core/dforge-mcp is pinned to clean release 0.2.22 or later. Treat any lockfile referencing version 0.2.21 as a confirmed indicator of compromise (IoC).
2. Network-Layer Telemetry on Web3 Gateways:
* Monitor corporate networks and developer workstations for outbound JSON-RPC calls directed at Ethereum nodes containing transaction query methods (eth_getTransactionByHash, eth_getTransactionReceipt).
3. Behavioral Code Analysis Over Pure Provenance:
* Do not treat cryptographic signatures as a substitute for behavioral and dynamic analysis. Integrate static analysis tools that inspect packages for obfuscated strings, unexpected network hooks, or child process executions prior to registry ingestion.
Indicators of Compromise (IoCs)
* Compromised npm Packages:
* @dforge-core/dforge-mcp@0.2.20 (Failed build)
* @dforge-core/dforge-mcp@0.2.21 (Active malicious release with GHAPPIER loader)
* Clean Remediation Version:
* @dforge-core/dforge-mcp@0.2.22
* File Paths & Artifacts:
* Injected loader scripts within dist/index.js and dist/mcp-server.js
* Observed Network Activity:
* Outbound JSON-RPC requests to public Ethereum gateways: cloudflare-eth.com, rpc.ankr.com/eth, mainnet.infura.io
* Associated Campaigns: PolinRider (Active since March 2026)
For technical threat intelligence updates and supply-chain vulnerability reports, follow Digital Spying.