What happened
CloudSEK (disclosed ~20-22 Sept 2026) documented GHAPPIER, a previously unreported JavaScript loader distributed via compromise of the legitimate npm MCP package @dforge-core/dforge-mcp on 9 Sept 2026. The malicious release carried valid attested provenance because attackers abused GitHub Actions OIDC trusted publishing, masking that the build itself was from malicious source; the loader spans 65+ repositories and is linked to the PolinRider campaign.
Why it matters
Direct supply-chain attack on the AI/agent tooling ecosystem: an MCP server package (the same class of component already under wide attack in 2026) delivered a remote-shell loader, and the package was signed with provenance that falsely scaled trust. Any AI agent deployment attaching to compromised MCP servers would execute the attacker's shell in the agent runtime context.
Attack vector
Attackers compromised the maintainer account of the @dforge-core/dforge-mcp npm package (an MCP server deployment tool), modified the GitHub Actions release workflow to auto-publish via OIDC trusted publishing, and shipped version 0.2.21 containing the GHAPPIER loader behind valid Sigstore provenance. The loader fired when the MCP server was launched (not on install), running a four-stage chain that ended in a self-deleting remote shell.
Affected systems
@dforge-core/dforge-mcp npm package (MCP server) version 0.2.21; campaign spans 65+ public repositories / 22 accounts
Mitigation
Upgrade to clean @dforge-core/dforge-mcp >= 0.2.22; review launches of any previously installed copy; treat signed/npm-provenance packages as still untrusted; check CloudSEK IoCs for the loader and its staging host. Clean version restored after the malicious release was live ~35 min.