// tag
Security incidents tagged Infostealer. Newest first.
› @subql/common (npm) and downstream @subql/* packages
On Oct 5 2026 @subql/common 5.8.3 was published to npm through SubQuery's own GitHub Actions trusted publisher, after a short-lived branch changed the release step to swap the built package for a tarball downloaded from ci-artifacts.dev. The payload ran on install (postinstall) and on import, stole CI/cloud/GitHub/npm/Kubernetes/Vault/SSH and AI-tool credentials, offered a reverse shell, and with a workflow-scoped token tried to push a secret-dumping workflow. It was live about 50 minutes; 5.8.2 is the safe version. Many @subql packages accept 5.8.3 through their version ranges.
We have published a new blog post covering a recent software supply chain attack on the @subql/common npm package. It covers technical details of the compromised package, as well as guidance on response if affected, as well as recommendations for users to protect against supply
