GHAPPIER Malicious npm Publish of @dforge-core/dforge-mcp v0.2.21

Ibrahim Saud@tektrix

•updated Sep 21, 2026•0•0•1

Detects the publication of a known malicious version (0.2.21) of the '@dforge-core/dforge-mcp' npm package. This activity is attributed to the GHAPPIER/PolinRider supply chain campaign, which leverages hijacked OIDC trusted-publishing pipelines to distribute compromised code.