# Compromised maintainer publishes backdoored release New versions or rewritten tags from stolen maintainer credentials adding install-time code or droppers _Area: Software supply chain and CI/CD. Seen in 2 disclosed reports; latest 2026-06-02. Updated 2026-11-07._ ## How it works A release is trusted because it comes from the maintainer's account or a signed tag. That assumption breaks when the account, token, or org credential is stolen: the attacker publishes with the same identity and tooling the project already uses, so nothing in the normal "new version" flow looks wrong. The malicious code runs at install or autoload time (postinstall scripts, `autoload.files`), before anyone reviews the diff. Long-lived tokens can also override stronger auth: in axios, an `NPM_TOKEN` took precedence over configured OIDC Trusted Publishing [E1](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-supply-chain-compromise-axios-npm-package.md). ## Where it shows up - New package versions adding `postinstall`/`preinstall` scripts or a new dependency that only exists to run a dropper [E1](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-supply-chain-compromise-axios-npm-package.md) - `composer.json` gaining an `autoload.files` entry pointing at a new helper file [E2](https://bugbountylibrary.com/r/blog%3Astepsecurity-io-blog-laravel-lang-supply-chain-attack.md) - Every tag in a repo (or several repos) rewritten at once, with identical fake author metadata [E2](https://bugbountylibrary.com/r/blog%3Astepsecurity-io-blog-laravel-lang-supply-chain-attack.md) - Commits reachable only from tags, not from any branch [E2](https://bugbountylibrary.com/r/blog%3Astepsecurity-io-blog-laravel-lang-supply-chain-attack.md) - Commits with unverified badges, or GPG key/author mismatch [E3](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-threat-actors-target-crypto-orgs.md) - Long-lived publish tokens still active alongside OIDC/Trusted Publishing [E1](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-supply-chain-compromise-axios-npm-package.md) ## How to review Check the exact property: does the published artifact's code match a reviewed commit, and does that commit belong to a branch? For each new version or tag, diff the tag target against the branch head; a tag pointing at an unreachable commit is unsafe [E2](https://bugbountylibrary.com/r/blog%3Astepsecurity-io-blog-laravel-lang-supply-chain-attack.md). Confirm no new install-time hooks or autoload entries were added [E1](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-supply-chain-compromise-axios-npm-package.md)[E2](https://bugbountylibrary.com/r/blog%3Astepsecurity-io-blog-laravel-lang-supply-chain-attack.md). Verify commit signatures and that the signing key belongs to the claimed author [E3](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-threat-actors-target-crypto-orgs.md). Confirm publish credentials are short-lived and that no static token can bypass OIDC [E1](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-supply-chain-compromise-axios-npm-package.md). ## How finders spotted it - A single odd binary path (`C:\ProgramData\wt.exe`) appearing across multiple hosts and organizations signaled a shared upstream source, not one host [E1](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-supply-chain-compromise-axios-npm-package.md) - Recognized `wt.exe` as a renamed `powershell.exe` masquerading as Windows Terminal [E1](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-supply-chain-compromise-axios-npm-package.md) - Traced the dropper back through the phantom dependency's `setup.js` to its C2 domain [E1](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-supply-chain-compromise-axios-npm-package.md) - Noticed every tag across several repos showed creation time "1 hour ago" with identical fake author `Your Name ` [E2](https://bugbountylibrary.com/r/blog%3Astepsecurity-io-blog-laravel-lang-supply-chain-attack.md) - Diffed commits to find the `autoload.files` addition, then detonated the version under a sandboxed runner [E2](https://bugbountylibrary.com/r/blog%3Astepsecurity-io-blog-laravel-lang-supply-chain-attack.md) - Correlated GitHub audit-log IPs and Vigilant Mode unverified badges with GPG key/author mismatch to trace pushes to a compromised endpoint [E3](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-threat-actors-target-crypto-orgs.md) ## Variants seen - Stolen npm maintainer account plus long-lived token publishing a backdoored release with a phantom dependency dropper [E1](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-supply-chain-compromise-axios-npm-package.md) - Org-wide push credential force-rewriting every existing tag to add an autoload dropper [E2](https://bugbountylibrary.com/r/blog%3Astepsecurity-io-blog-laravel-lang-supply-chain-attack.md) - Endpoint RAT harvesting credentials, then pushing malicious commits and a trojanized SDK version [E3](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-threat-actors-target-crypto-orgs.md) ## Impact and severity High: install-time code reaches every consumer and CI runner, harvesting npm tokens, cloud keys, and SSH keys [E1](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-supply-chain-compromise-axios-npm-package.md). Tag rewriting poisons all version ranges (`^3.4`, `~2.0`, `*`), not just one release [E2](https://bugbountylibrary.com/r/blog%3Astepsecurity-io-blog-laravel-lang-supply-chain-attack.md). Stolen endpoint credentials escalated to public package distribution [E3](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-threat-actors-target-crypto-orgs.md). ## Why fixes fail Deleting the dropper file is insufficient: the phantom dependency directory persists as the durable IOC after `setup.js` is removed and `package.json` swapped for a clean stub [E1](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-supply-chain-compromise-axios-npm-package.md). Normal version-diff review misses force-pushed tag targets invisible from branches [E2](https://bugbountylibrary.com/r/blog%3Astepsecurity-io-blog-laravel-lang-supply-chain-attack.md). ## Seen in real software Open-source packages and projects, and products, where this pattern was found. If the target runs one, compare the version it runs with the fix. - **Laravel-Lang** (composer.json autoload.files / src/helpers.php) (version not stated): Laravel-Lang Supply Chain Attack: Every Tag Across Multiple Composer Packages Rewritten to Steal CI Secrets. Report: https://bugbountylibrary.com/r/blog%3Astepsecurity-io-blog-laravel-lang-supply-chain-attack.md ## Evidence - E1: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-supply-chain-compromise-axios-npm-package.md - E2: https://bugbountylibrary.com/r/blog%3Astepsecurity-io-blog-laravel-lang-supply-chain-attack.md - E3: https://bugbountylibrary.com/r/blog%3Awiz-io-blog-threat-actors-target-crypto-orgs.md