Attackers Abuse npm Trusted Publishing in GHAPPIER Campaign

As cited

Copy frozen at 2026-09-21 14:51 UTC (site build).

threat intel

Attackers Abuse npm Trusted Publishing in GHAPPIER Campaign

CloudSEK identified the GHAPPIER campaign using a compromised npm package that contained valid trusted-publishing provenance, indicating attackers have obtained access to legitimate publishing credentials or mechanisms. The attack exploits npm's trusted-publishing feature, which is designed to verify package authenticity, to distribute malicious code with apparent legitimacy.

Why it matters: Developers relying on npm package trust signals and supply chain confidence are at risk; practitioners managing software dependencies must review GHAPPIER indicators of compromise (IOCs) and validate package provenance even when signatures appear valid.

Source published

2026-09-21 13:30 UTC

First seen by Cybersecurity Tracker

2026-09-21 13:50 UTC