Software Supply Chain Attack on @subql/common: Overview and Response Guidance

Tue, 06 Oct 2026 00:00:00 +0000

Note) This post is a direct translation of this post .

On October 5, 2026, malicious code was injected into the npm package @subql/common, a package developed in SubQuery’s GitHub repository, subquery/subql.

The injected malicious code combines infostealer and C2 backdoor functionality. Executed via a postinstall hook, it steals credentials for AWS, GitHub, Kubernetes, Vault, etc. and exfiltrates them to a C2 server. It is also capable of accepting remote commands from a reverse shell. The attacker who injected this malicious code tampered with the CI/CD workflow of the subql GitHub repository, and published the malicious version via GitHub Actions OIDC (Trusted Publisher), making it difficult to distinguish from a legitimate release.

Malware on GMO Flatt Security Research

Software Supply Chain Attack on @subql/common: Overview and Response Guidance