@subql/common (npm): backdoored 5.8.3 published through the project's own CI after an unauthorized release-workflow change (no CVE)
Severity: high · Patch status: patched · Since 2026-10-05
On 2026-10-05 at 11:56 UTC @subql/common 5.8.3 was published to npm by SubQuery's own GitHub Actions trusted-publisher workflow, after an unsigned commit on a short-lived branch changed publish.yml to delete packages/common and replace it with an unverified tarball fetched from ci-artifacts.dev. A harmless canary build, 5.8.3-onf-rt1 under a 'redteam' tag, had gone out about 32 minutes earlier. The payload ran from a postinstall script and also on a plain require/import, so disabling install scripts is not enough. Per static analysis it collects environment variables, .npmrc, .env, cloud, SSH, Kubernetes, Vault and wallet files and the gh token, tries to read GitHub runner memory, encrypts the data to ci-artifacts.dev, offers a reverse shell, and tries to push a secrets-dumping CodeQL-named workflow with stolen GitHub tokens. The version was removed from npm after an estimated 50 minutes and 5.8.2 is the safe release; StepSecurity found 19 latest @subql packages whose ranges could resolve to 5.8.3. The maintainers said on 2026-10-10 that a compromised token was deleted and a review started; who made the unauthorized commit is not established.
What to do
- Search lockfiles, node_modules and CI caches for @subql/common 5.8.3 (including transitive paths through @subql/cli 6.6.3, node-core 19.3.1, query 2.25.0, node-ethereum 6.5.0 and others) and pin or override to 5.8.2
- If 5.8.3 was installed with scripts enabled or imported, isolate the host or runner, kill any process running manifest-cache.js, and rebuild from a trusted image since uninstalling does not stop the detached worker
- Rotate everything reachable by those processes: GitHub tokens and Actions secrets, npm tokens, cloud keys (AWS across regions), SSH keys, Kubernetes and Vault secrets, Docker registry credentials
- Block ci-artifacts.dev, hunt for the lock file tmp.ts018051808.lock in the OS temp directory, and check GitHub for an unexpected dependabot/github_actions/format/setup-formatter branch or .github/workflows/codeql_analysis.yml
- Set a minimum release age for new npm versions so a fresh publish is not installed within minutes
Fixed versions
- @subql/common 5.8.2 (last good release; 5.8.3 removed)
Sources
All live incidents on Threat Watch
