TLDR Tech / Practical
Compromised npm Package @subql/common Distributes Malware
A security incident involving the npm package @subql/common, specifically version 5.8.3, has been identified. A compromised GitHub Actions CI/CD pipeline introduced malicious code containing an infostealer and a command-and-control backdoor. This payload activates automatically, either through a postinstall script or when the module is imported, to gather sensitive information from configuration files, environment variables, cloud credentials, and system memory before transmitting it externally. Mitigation strategies include disabling script execution during package installation, implementing delays for dependencies, and utilizing security proxies.
Read the full story