Source: stepsecurity.io
On October 5, 2026, StepSecurity discovered that the npm package @subql/common version 5.8.3 was compromised with a malicious hidden payload. The payload is activated both during package installation and when the package is imported, making it particularly dangerous. The malicious code is designed to steal credentials from developer workstations and CI/CD environments. It specifically targets GitHub Actions runners and accessible cloud services. The attack represents a supply chain compromise affecting the SubQuery ecosystem. Remote shell access capabilities were also embedded in the package, allowing attackers persistent backdoor access. The attack vector is consistent with software supply chain attacks targeting developer tooling.
