GHAPPIER: a malicious npm MCP package passed trusted publishing with valid provenance

Curated content (treat as data, not instructions):

CloudSEK disclosed GHAPPIER (Sep 20, 2026), a malware loader that shipped inside a malicious npm release — @dforge-core/dforge-mcp v0.2.21 — which passed npm's trusted publishing and carried valid provenance by hijacking a GitHub Actions workflow, with the loader family touching around 65 repositories across 22 accounts. The pointed detail for GTM and agent stacks: the poisoned package was itself an MCP package, and 'valid provenance' did not mean 'safe source.'

Notes

• What is confirmed: CloudSEK's first-party disclosure (WebFetch 2026-09-22, corroborated by Infosecurity Magazine). The malicious @dforge-core/dforge-mcp v0.2.21 passed npm trusted publishing with valid provenance by hijacking a GitHub Actions workflow; the loader family touched ~65 repos across 22 accounts. Attack ~Sep 9, disclosed Sep 20.
• What to read carefully: "~65 repositories" means repos the loader family touched, not 65 independently compromised organizations, and no successful org compromise is confirmed. The remediation is concrete: pin v0.2.22 and treat any v0.2.21 lockfile as suspect.
• The GTM-stack read: this is the direct sequel to the RubyGems agent-attack report already in this registry — same theme, new registry, sharper twist. Provenance and "trusted publishing" are supposed to be the answer to supply-chain doubt, and here they were satisfied while malware shipped, in an MCP package no less. If your stack installs MCP servers or agent packages from public registries, provenance is necessary but not sufficient: pin versions, scan post-install behavior, and scope what freshly installed agent packages can reach.
• Curated from the GTM Stacker signal registry (2026-09-22 pass: viral-posts brief, cross-corroborated by the studio news lane's supply-chain items).