TLDR Tech / Practical
SubQuery Ecosystem Compromise: Hidden Credential Theft and Backdoors
StepSecurity researchers report that version 5.8.3 of the open-source npm package @subql/common contains a hidden credential theft payload and remote shell backdoors. The malicious release, triggered upon installation and import, collects local credentials, environment variables, browser secrets, and cloud configuration data while injecting GitHub Actions workflows to exfiltrate information. Users are advised to block the associated domain, prevent installation, and rotate compromised secrets.
Read the full story