Forged-commit preinstall dropper: hugo-paper & mevn-cli — attacker force-pushed malicious preinstall hook fetching second stage from buildwithknexus.xyz
Severity: high · Patch status: no-fix-needed · Since 2026-10-20
An attacker with stolen push credentials (inferred, unconfirmed) pushed forged commits to the default branches of the hugo-paper and mevn-cli GitHub repositories on 2026-08-20 and 2026-08-21. The commits copy the author, timestamp, and message of legitimate tip commits, and add a scripts/preinstall.js hook as the first entry in package.json. Running npm install or bun install in either repository silently downloads and executes a second-stage script from buildwithknexus[.]xyz (checkw on Windows via curl.exe/cmd, checkm on macOS/Linux via nohup/bash). No npm package carries the payload, so registry scanners miss it; the last mevn-cli npm release (1.8.3, 2022) is clean. The attacker revised the Windows loader once. Forks and copies made after the attack inherit the payload. SafeDep could not retrieve the second stage and treats any machine that ran the hook as compromised. Technique resembles GlassWorm/ForceMemo. No vendor fix; remediation is repo cleanup and host forensics.
What to do
- Treat any machine where npm install or bun install was run against hugo-paper or mevn-cli (or the listed forks/copies) since 2026-08-20 as compromised; isolate and investigate
- Audit git history of clones/forks: check for single-parent merge commits, missing 'Verified' badges, and scripts/preinstall.js in package.json
- Block buildwithknexus[.]xyz at network/proxy level and hunt for connections to it or curl fetches of /check_m and /check_w
- Re-clone from verified clean commits (e.g. original de1169ec / pre-attack tips) rather than pulling latest main
- Rotate developer credentials and enforce commit signing / branch protection on internal repos to prevent similar forged-push attacks
Sources
All live incidents on Threat Watch
