AppSec · 10h ago
CloudSEK said attackers used the maintainer account for @dforge-core/dforge-mcp for 105 minutes on September 9 to push a malicious npm release, version 0.2.21, through GitHub Actions trusted publishing. The package carried a valid OIDC attestation in Sigstore, even though the source had been tampered with.
The attacker changed the release workflow so a push to the main branch triggered the real build and signing pipeline, which then published the modified package as if it were legitimate. That matters because provenance checks can confirm where a package was built, but not that the source feeding the build was honest; downstream verification can still see a clean-looking release.
The blast radius is any environment that installed 0.2.21 and then ran the MCP server, because the loader fired at launch rather than install time. For teams that rely on GitHub Actions and OIDC to prove release integrity, this is a trust break in the publishing path itself, not just in the package registry.
1 source covering this story
Attackers Abuse npm Trusted Publishing in GHAPPIER Campaign
CloudSEK linked GHAPPIER to a compromised npm package with valid trusted-publishing provenance
Part of the PlainSec briefing for 2026-09-21