SubQuery @subql/common · Exploitation confirmed

Malicious @subql/common 5.8.3 steals credentials and opens backdoor

Oct 05, 2026 · 1 min read

Version 5.8.3 of npm package @subql/common, published on October 5, 2026 after tampering with the subquery/subql repository CI workflow, steals AWS, GitHub, Kubernetes and Vault credentials and accepts commands via reverse shell. Advisory GHSA-9333-3c4x-x3h5 was published and the version was removed from npm around 12:46 UTC per GMO Flatt Security, but the 'redteam' dist-tag still points to the attacker's canary version. Pin 5.8.2, remove 5.8.3, block ci-artifacts.dev, and rotate credentials on environments that installed or imported the package.

By HIFY Radar newsroom Updated 10/26/2026 01:34 PM Get this every day →← Back to the feed 5 sources

HighSupply chainExploitation confirmedPartial fix

In this article

What happened
Why it matters
What to do
For the technical team
Timeline
Sources

What happened

Version 5.8.3 of the npm package @subql/common, part of the SubQuery ecosystem, was published with malicious code on October 5, 2026. The attacker tampered with the official publishing workflow, and npm recorded the release as a Trusted Publisher. The code steals credentials and allows remote control; the version was removed from npm the same day.

Why it matters

The library is a shared dependency: StepSecurity identified 19 of 77 @subql packages with a path to the malicious version, without a new release of the parent packages. Per the GitHub advisory, any computer with the package installed or running must be considered fully compromised, with cloud credentials, tokens and keys exposed.

What to do

Pin @subql/common to 5.8.2 and block version 5.8.3 and the domain ci-artifacts.dev in dependency controls. Inventory machines and pipelines that installed or imported the package, remove it, and rotate all credentials (AWS, GitHub, SSH, Kubernetes, Vault.env and .npmrc files) from a different computer. Check for persistence: the manifest-cache.js --warm process and the /tmp/tmp.ts018051808.lock file.

For the technical team

Affected: SubQuery @subql/common (npm) e pacotes downstream @subql/* · @subql/common 5.8.3 and 5.8.3-onf-rt1 (attacker canary, no payload recovered; the 'redteam' dist-tag still points to it). Downstream that resolves to 5.8.3: @subql/cli 6.6.3 and @subql/node-core 19.3.1 (~5.8.2), @subql/query 2.25.0 (~5.8.1), @subql/node-ethereum 6.5.0 (^5.8.2). Indirect paths via @subql/node-core: @subql/node 6.4.6, @subql/node-solana 6.3.5, @subql/node-starknet 6.1.0 (StepSecurity). Pinning a parent package does not pin its dependencies.
Exploitation: Malicious code confirmed by static analysis; Amazon Inspector credited as finder in OSV (MAL-2026-17571), StepSecurity decoded the payload without executing it, and GMO Flatt Security detailed the infostealer and C2 agent. No exploitation against specific victims reported in the sources. Advisory GHSA-9333-3c4x-x3h5 and OSV entry published on October 5, 2026.
Fix: Known safe version: @subql/common 5.8.2 (npm 'latest'). 5.8.3 was removed from npm around 12:46 UTC on October 5 (GMO Flatt Security estimate from the registry timestamp). Mitigations: block ci-artifacts.dev, remove 5.8.3 and 5.8.3-onf-rt1, pin the dependency tree, rotate credentials from a different computer, terminate manifest-cache.js --warm processes, and assume an active reverse shell.
Vector: Compromise of the GitHub repository subquery/subql: the attacker obtained push access, tampered with .github/workflows/publish.yml to download https://ci-artifacts.dev/pkg/@subql-common-5.8.3.tgz and replace the legitimate package, and published 5.8.3 via GitHub Actions OIDC (Trusted Publisher). Entry point: postinstall 'node ./dist/project/readers/manifest-cache.js' runs on every npm install, no require needed; the payload also starts on import, since dist/index.js re-exports manifest-cache and ManifestCacheReader.warm spawns a detached node process with --warm. Disabling install scripts alone is insufficient (StepSecurity).
More details: Payload (Amazon Inspector): ~60 KB of base64 (MANIFEST_CACHE_SEED) decoded with XOR 0x5a and zlib.gunzipSync, evaluated via new Function; source map scrubbed to hide the dispatcher. Behavior (GMO Flatt Security): daemonization with detached process and lock file; enumerates and reads AWS SSM Parameter Store and Secrets Manager across all regions; steals GitHub tokens (GITHUB_TOKEN, ghp_ and gho_ PATs), SSH keys.env.npmrc, Docker config, Kubernetes config, Vault tokens; excludes Russian-language environments; embedded obfuscated toolkit with AES-256-GCM scripts; GitHub Actions workflow injection; API calls with AWS Signature V4; reverse shell. UTC timeline on Oct 5, 2026 (StepSecurity and Flatt): 11:23 branch chore/ci-audit-55 created; 11:24:40 5.8.3-onf-rt1 published; 11:52 commit 506863d '[release] 5.8.3' pushed under the name Ian He <ian@onfinality.io>, not GPG-signed, while prior legitimate commits are signed (last one on 2026-04-01); 11:56:29 5.8.3 published; ~12:46 removed from npm. StepSecurity opened issue #3047 in the SubQuery repository. CWE-506 in OSV. 5.8.2 was published on November 20, 2025.