Executive Summary
In September 2026, researchers identified a sophisticated supply chain attack targeting the npm package @dforge-core/dforge-mcp. A threat actor leveraged compromised developer credentials to hijack the legitimate publishing pipeline through OIDC trusted publishing, successfully shipping a malicious version (0.2.21) of the package. The attack utilized a previously unreported loader family dubbed GHAPPIER, which has been identified across at least 65 public repositories and 22 different developer accounts.
The intrusion is technically linked to the DPRK-affiliated campaign PolinRider (also associated with FAMOUS CHOLLIMA/Contagious Interview). A key feature of this campaign is the use of Ethereum blockchain dead-drops to retrieve command-and-control (C2) infrastructure, rendering traditional domain takedowns ineffective. The GHAPPIER loader initiates a four-stage execution chain that ultimately deploys a remote access trojan that deletes itself from disk upon execution, complicating forensic recovery.
This incident highlights a critical gap in supply chain security: valid provenance attestations (like SLSA) confirm where an artifact was built but do not guarantee the integrity of the source code when a developer's CI identity is compromised. Organizations are advised to move beyond simple IOC blocking and focus on behavioral detection of unauthorized CI/CD pipeline modifications and anomalous Node.js runtime executions.