GHAPPIER Malware Hijacks 65 GitHub Repositories to Deploy Self-Deleting Backdoor

A supply-chain attack linked to the GHAPPIER malware campaign compromised the legitimate npm package @dforge-core/dforge-mcp and briefly distributed a self-deleting backdoor. The incident began on September 9, 2026, when an attacker used the maintainer account of the package for about 105 minutes. The attacker already had permission to push code... Weiterlesen