GHAPPIER - One loader, sixty-five repositories, twenty-two accounts: an unreported loader family beside DPRK's PolinRider campaign
GHAPPIER loader compromised an npm package via trusted publishing, delivering a four-stage chain that reads C2 from Ethereum blockchain transactions and self-deletes on execution. A compromised npm maintainer account published malicious version 0.2.21 of @dforge-core/dforge-mcp with valid Sigstore provenance through GitHub Actions OIDC. The payload hides at line 3320 of a 99 KB config file and launches a four-stage chain whose final implant deletes itself from disk on startup. C2 addresses are read from Ethereum blockchain wallet transactions, leaving no domain or host to block.
Detection / Hunteropenrouter
Immediate Actions
- Pin @dforge-core/dforge-mcp to version 0.2.22 or later
- Sweep for intermediate stage artifacts rather than the self-deleting final implant
- Audit all systems that installed version 0.2.21 between 9-10 September 2026
- Rotate any git credentials cached on developer machines that ran 0.2.21
Key Takeaways
- Compromised version 0.2.21 was the npm registry's latest release for 35 minutes 38 seconds on 9 September 2026
- 65 public repositories, 73 infected files, and 22 accounts span the GHAPPIER operation
- Final implant self-deletes from disk immediately on execution, leaving no file artifact
- C2 address encoded in 20 bytes of an Ethereum recipient address on an empty transaction costing ~$0.20
- PolinRider campaign linked via identical payload-append-to-config-file technique tracked since March 2026
Attack Chain
- Initial Access: Attacker uses compromised npm maintainer account credentials to push to main branch
- Supply Chain: Malicious version 0.2.21 published via GitHub Actions OIDC trusted publishing with valid Sigstore provenance
- Execution: Remote code loader at line 3320 of 99 KB config file starts four-stage chain
- C2: Final stage reads C2 address from Ethereum blockchain wallet transaction data
- Defense Evasion: Final implant deletes itself from disk immediately on execution
Affected Systems
- npm/Node.js development environments
- CI/CD pipelines using GitHub Actions OIDC trusted publishing
- Developer workstations with cached git credentials
- Organizations consuming @dforge-core/dforge-mcp version 0.2.21
Detection Availability
No detection rules or queries are published in the source article.
Detection Engineering Assessment
Hypotheses are starting points derived from the article, not findings about your environment; validate against your own telemetry.
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Medium | Self-deleting implant leaves no file artifact; intermediate stages and process spawning may be visible. |
| Network Visibility | Low | C2 via Ethereum blockchain transactions has no domain, host, or traditional network indicator to detect. |
| Detection Difficulty | Hard | Valid provenance, self-deleting implant, and blockchain-based C2 eliminate most traditional detection surfaces. |
Hunting Hypotheses
| Hypothesis | Telemetry | Stage | FP Risk |
|---|---|---|---|
| npm install processes spawning unexpected child processes or network connections to blockchain APIs (T1059, T1071) | Process execution and network connection logs | Execution | Medium — legitimate packages may spawn build tools |
| Process creating then immediately deleting an executable file at startup (T1070.004) | File creation and deletion events with process lineage | Defense Evasion | Low — self-deletion on execution is rare in legitimate software |
| Large config files with appended executable content at high line numbers (T1027) | File integrity monitoring and static analysis of config files | Execution | Low — appended code in config files is unusual |
| Processes querying Ethereum blockchain APIs to resolve wallet transaction recipient addresses as C2 (T1071) | Network proxy logs and DNS resolution for blockchain API endpoints | Command and Control | Medium — blockchain API access may be legitimate in dev environments |
Required Log Sources
- npm install logs
- process execution telemetry
- Ethereum blockchain transaction monitors
- GitHub Actions workflow logs
- file creation and deletion events
Key Behavioral Indicators
- npm package version 0.2.21 of @dforge-core/dforge-mcp
- Process spawning from npm install context
- Executable file creation followed by immediate deletion
- Network connections to Ethereum blockchain API endpoints
- Code appended at high line numbers in config files
- GitHub Actions workflow modifications enabling unattended publishing
Control Gaps
- Sigstore provenance validates build origin not source honesty
- npm trusted publishing grants publish access via repository push alone
- No OSV or GitHub advisory was published for the compromised version
- Traditional file-based scanning misses self-deleting implants
- Blockchain-based C2 bypasses domain and IP blocklists
False Positive Assessment
Low — self-deleting implants and blockchain-based C2 are rare in legitimate software; npm package version correlation narrows scope.
Recommendations
Suggestions to evaluate against your own environment, tooling, and incident-response procedures — not directives.
Infrastructure Hardening
- Require manual approval for npm package publishing workflows
- Monitor GitHub Actions OIDC token usage for anomalous publish events
- Block known Ethereum blockchain API endpoints from non-developer network segments
- Implement package version pinning across all CI/CD pipelines
User Protection
- Deploy EDR rules for process self-deletion behavior on developer endpoints
- Scan developer machines for cached git credential exposure
- Restrict browser extension and development tool installation on developer endpoints
Security Awareness
- Train developers on npm trusted publishing risk: push access equals publish access
- Establish a policy for rapid advisory publication when package versions are withdrawn
MITRE ATT&CK Mapping
Resource Development
Initial Access
Execution
Credential Access
Command and Control
Plain-Language Summary
Attackers compromised a legitimate npm package maintainer's account for 105 minutes and published a malicious version that passed all security checks because it was built through GitHub's trusted publishing system. The malicious code hides inside a large configuration file and launches a multi-stage attack where the final component deletes itself from the computer, making it hard to detect. The attackers communicate with their malware by encoding instructions in Ethereum cryptocurrency transactions, so there is no website or server to shut down. Organizations using this npm package should pin to the clean version 0.2.22 and check for the intermediate files the attack leaves behind rather than searching for the self-deleting implant.