Executive Summary

On 9 September 2026 someone used the maintainer account of a legitimate npm package, @dforge-core/dforge-mcp, for 105 minutes. They already had the ability to push to its main branch when the intrusion began; how they obtained that is the one thing that we cannot definitely answer for now. However, we suspect that it was likely a developer infected with a malicious extension or package that allowed this level of access to the attackers. WIthin the brief window in which the threat actor had access to the developer creds, they added a remote code loader, changed three lines so that any push to the main branch started the release workflow, rewrote that workflow fourteen minutes later so it could publish unattended, and shipped the loader as version 0.2.21. It was the registry's latest release for 35 minutes and 38 seconds before the maintainer reverted everything and published a clean 0.2.22. 

There are three interesting observations from the attack that unfolded. First, the compromised release carried valid npm provenance: it was built by GitHub Actions through OIDC trusted publishing, and its attestation still exists in Sigstore's append-only log, naming the attacker's own commit. Nothing was forged and nothing malfunctioned, the attestation is an accurate record of a dishonest input, because provenance attests where an artefact was built, not whether its source was honest. It also explains why no npm credential was needed: under trusted publishing the registry trusts the repository's CI identity, so push access was publish access. Second, the payload is one line at 3320 of a 99 KB file, opening a four-stage chain whose final implant deletes itself from disk the moment it runs. An organisation that executed the release and then searched its machines for a malicious file would find nothing and could reasonably conclude it was unaffected. Every stage still answered when tested five days after the withdrawal.

Third, and found late, a second payload family in another victim's repository ties this to a documented campaign: PolinRider, a DPRK-linked operation that OpenSourceMalware has tracked across thousands of repositories since March 2026, whose signature is exactly this: a payload appended silently to the end of a real project configuration file. It carries no command-and-control address at all. It reads one off the Ethereum blockchain from a wallet published as an indicator for that campaign. An exact match was still beaconing as this report was written. In this case, the configuration is written into the twenty bytes of a recipient address on an empty transaction costing about twenty cents, which means the channel has no domain to suspend, no host to seize and no account to disable. Campaign membership is this report's own finding, established from the sample. The researchers who documented NullReceiver further attribute it to North Korea; that step is theirs rather than ours, it is cited here rather than asserted, and the one independent check we could run did not confirm it.

The campaign's documented method that is to harvest a developer's cached git credentials from an infected machine, then push with them is also the most plausible account of how this maintainer's account came to be used, and it explains why the same borrowed name appears across dozens of unrelated repositories. The immediate actions are to block the socket endpoint and the two delivery hostnames, sweep for the artefacts the chain leaves behind rather than for the implant, which deletes itself at startup, and pin the package at 0.2.22. The exposed population is small, and nothing here evidences a successful compromise of any organisation. What it evidences is that the remediation everyone performed, withdrawing a version that removed the cheapest component of the operation and left the rest reachable, with no advisory in OSV, in the GitHub database, or from the maintainer to tell anyone still holding 0.2.21 that they should look.

Click here to download the full report for the complete attack timeline, malware analysis, campaign infrastructure, attribution assessment, indicators of compromise and defensive recommendations.