GHAPPIER - One loader, sixty-five repositories, twenty-two accounts: an unreported loader family beside DPRK's PolinRider campaign

On 9 September 2026 a compromised maintainer account was used to publish a malicious npm release (@dforge-core/dforge-mcp v0.2.21) for 105 minutes; the release was built via legitimate GitHub Actions OIDC provenance and contained a four-stage payload that self-deletes at runtime. The attack appears linked to the PolinRider campaign (researchers previously tracked) which appends payloads to project files and retrieves configuration from the Ethereum blockchain; recommended actions are to block endpoints, sweep for artifacts left by the chain, and pin the package to the clean 0.2.22 release.