Malicious npm publish of @dforge-core/dforge-mcp v0.2.21 via OIDC

Ibrahim Saud@tektrix

•updated Sep 21, 2026•0•0•3

This rule monitors for the presence of a specific, known malicious package (@dforge-core/dforge-mcp version 0.2.21) being referenced in file paths, indicative of a software supply chain compromise or the distribution of malicious dependency artifacts.