# SubQuery Ecosystem Compromise: Hidden Credential Theft and Backdoors

Malicious @subql/common@5.8.3 npm release hides a credential-stealing payload that runs on install and import, targeting developer workstations and CI runners.

- Payout: Real-world hack
- Severity: critical
- Program: SubQuery
- Analysis by: StepSecurity
- Disclosed: 2026-10-05
- Write-up quality: 8/10
- Original: https://www.stepsecurity.io/blog/subql-ecosystem-compromised
- Library page: https://bugbountylibrary.com/r/blog%3Astepsecurity-io-blog-subql-ecosystem-compromised
- Tags: area:oss domain:oss impact:data-leak impact:internal-access kind:incident platform:threat-intel sev:critical tech:ci-cd tech:github-actions tech:nodejs technique:source-review vuln:rce vuln:secrets-leak

**Target:** npm package @subql/common (install hook and import path)
**Root cause:** Attacker with repo write access pushed a canary workflow on a short-lived branch, then a release commit that substitutes an external artifact and bumps the version, publishing a tarball with three added manifest-cache files and modified package.json and readers/index.js.
**Steps:**
1. Download @subql/common@5.8.3 tarball and verify SHA-512 against npm metadata
2. Compare against 5.8.2: three manifest-cache files added, package.json and readers/index.js modified, dependencies unchanged
3. Decode the payload without executing it; observe it triggers on install and on import
4. Trace publication: branch `chore/ci-audit-55` created 11:23:01, canary commit 34128fd8cdc9 replaces Publish workflow, prerelease 5.8.3-onf-rt1 published 11:24:40.358
5. Branch deleted 11:27:17, recreated 11:52:38, release commit 506863d6fb82 adds external artifact substitution, 5.8.3 published 11:56:29.414
6. Block `ci-artifacts.dev` and hunt hosts where 5.8.3 ran
**How found:** StepSecurity's AI Package Analyst flagged the release as suspicious; analysts then diffed neighboring versions, decoded the payload statically, and reconstructed the branch/commit/publish timeline from GitHub events and npm provenance.
**Exploitation:** Payload runs during npm install and again when the package is imported, harvesting credentials from developer workstations, GitHub Actions runners and reachable cloud services, and providing remote shell access. External artifact substitution in the release workflow injects the payload into the published tarball.
**Escalation:** Shared dependency means pinned parent packages (@subql/cli, node-core, query, node-ethereum, node-solana, node-starknet) resolve to 5.8.3 via ~/^ ranges, spreading compromise across the ecosystem without new parent releases.
**Insight:** A file named like a manifest cache blends into a package that already loads manifests; check for install-hook AND import-time triggers, and correlate npm provenance run IDs with short-lived branches and workflow substitutions to catch artifact-swap supply-chain attacks.