npm package @dforge-core/dforge-mcp (versions 0.2.20/0.2.21); 65+ public GitHub repositories, 73 infected files, 22 accounts

Date (as written): 20/09/2026
Year: 2026
Country: UNKNOWN
Actors (as written): Unknown (possible unconfirmed link to PolinRider/North Korea)
Actor pages: Unknown
Tags (as written): Attack: Malware; Target Class: J - Information and communication; Attack Class: Cyber Crime; Initial Access: T1195.002 - Supply Chain Compromise: Compromise Software Supply Chain

Source entries (1)

Hackmageddon cyber attacks timelines (Paolo Passeri)

npm package @dforge-core/dforge-mcp (versions 0.2.20/0.2.21); 65+ public GitHub repositories, 73 infected files, 22 accounts · 20/09/2026

CloudSEK uncovers GHAPPIER, a malware loader distributed via a supply-chain compromise of the @dforge-core/dforge-mcp npm package with researchers noting a possible but unconfirmed link to the PolinRider campaign some attribute to North Korea. [Date Occurred: 09/09/2026; Date Discovered: 09/09/2026]

https://www.hackmageddon.com/2026/09/29/september-2026-cyber-attacks-timeline/

https://docs.google.com/spreadsheets/d/1sn0d9OIEXxw2D2hmWK69emA2dTuDXr0FeJba33JQUc4/export?format=csv&gid=0

https://www.infosecurity-magazine.com/news/attackers-abuse-npm-trusted/

Suggest a correction on GitHub