TLDR Tech / Practical
Malicious Code Found in Subql Package, Attack Details Released
A software supply chain compromise has been identified within the npm package @subql/common, version 5.8.3. Flatt Security researchers discovered that a compromised GitHub CI/CD pipeline inserted malicious code into the package. This code functions as an infostealer and C2 backdoor, automatically running through a postinstall hook to gather credentials, environment data, and important files from various systems before contacting a command-and-control server. The security analysis offers detailed steps for responding to the incident, identifying signs of compromise, and improving development security to prevent future supply chain threats.
Read the full story