npm Supply Chain Attack Exploits 'Trusted Publishing' to Smuggle Hidden Malware Loader

Security researchers at CloudSEK have uncovered a supply chain attack in which criminals hijacked a developer's npm maintainer account to publish a malicious package update carrying a new loader, dubbed GHAPPIER. The attacker had access to push code to the project's main branch for 105 minutes, and used that access to alter the GitHub Actions release workflow so any code push automatically triggered an unattended, signed release. Because npm trusts the identity of the automated build system rather than verifying the honesty of the code itself, the malicious release passed npm's audit signature checks and appeared fully legitimate.

The hidden loader was buried as a single line within a large file and only activated when the software's server component was actually run, meaning systems that installed the package but never launched it were not affected. CloudSEK traced related infections across at least 65 public repositories, 73 files and 22 accounts, and found a matching payload linked to an ongoing campaign known as PolinRider, which other researchers have tentatively linked to North Korean actors, though CloudSEK could not independently confirm this attribution.

Critically, CloudSEK stressed that no platform, registry, or package manager was actually hacked. Every malicious action was performed using a legitimate, stolen account, likely obtained through credential theft, highlighting how attackers increasingly favour hijacking trusted identities over exploiting technical vulnerabilities.