# Compromised maintainer publishes malicious package

Publishes from human accounts or manual registry uploads that bypass the trusted CI pipeline and provenance

_Area: Software supply chain and CI/CD. Seen in 3 disclosed reports; latest 2026-09-08. Updated 2026-11-01._

## How it works
A package's release path assumes the person or account allowed to publish is trustworthy and that the artifact came from the project's build pipeline. When a maintainer account is taken over (social engineering, or an infected developer machine), the attacker publishes directly to the registry. Nothing in the registry verifies that the upload came from CI, so a hand-published version with extra scripts or injected build files looks like any other release. The trust placed in "the maintainer published it" is the assumption that breaks.

## Where it shows up
- A publish identity that differs from the project's usual CI/OIDC trusted publisher, especially a sudden switch to a human account [E3](https://bugbountylibrary.com/r/blog%3Astepsecurity-io-blog-cline-supply-chain-attack-detected-cline-2-3-0-silently-installs-openclaw.md).
- Missing or absent provenance attestations on a new version [E3](https://bugbountylibrary.com/r/blog%3Astepsecurity-io-blog-cline-supply-chain-attack-detected-cline-2-3-0-silently-installs-openclaw.md).
- New `postinstall`/`preinstall` scripts, or scripts that fetch and globally install other packages [E3](https://bugbountylibrary.com/r/blog%3Astepsecurity-io-blog-cline-supply-chain-attack-detected-cline-2-3-0-silently-installs-openclaw.md).
- Obfuscated shell in `example/`, `test/`, `build.gradle.kts`, `project.pbxproj`, or git hooks — files never compiled as dependencies but built by anyone cloning the repo [E1](https://bugbountylibrary.com/r/blog%3Aaikido-dev-blog-compromised-flutter-package-on-pub-dev-contains-xcsset-malware.md).
- Obfuscated code hooking `fetch`/XHR or `window.ethereum`/Solana wallet APIs in bundled frontend JS [E2](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-widespread-npm-supply-chain-attack-breaking-down-impact-scope-across-debug-chalk.md).
- Popular utility packages pulled in transitively, far beyond their direct usage [E2](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-widespread-npm-supply-chain-attack-breaking-down-impact-scope-across-debug-chalk.md).

## How to review
For each release, check the invariant: the published artifact must be produced by the project's trusted pipeline, by the expected identity, with provenance, and contain no install-time or build-time code beyond what the source declares.
- Diff `_npmUser`/trustedPublisher and provenance against release history; a human-account publish plus missing provenance is a red flag [E3](https://bugbountylibrary.com/r/blog%3Astepsecurity-io-blog-cline-supply-chain-attack-detected-cline-2-3-0-silently-installs-openclaw.md).
- Read every lifecycle script and every file in the tarball, including `example/` and `test/` [E1](https://bugbountylibrary.com/r/blog%3Aaikido-dev-blog-compromised-flutter-package-on-pub-dev-contains-xcsset-malware.md)[E3](https://bugbountylibrary.com/r/blog%3Astepsecurity-io-blog-cline-supply-chain-attack-detected-cline-2-3-0-silently-installs-openclaw.md).
- Inventory lockfiles and built bundles, not just direct dependencies [E2](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-widespread-npm-supply-chain-attack-breaking-down-impact-scope-across-debug-chalk.md).

## How finders spotted it
- Scanned registry tarballs and found obfuscated shell in `example/` build files; matched `printf|tr` obfuscation and C2 domains to known malware modules [E1](https://bugbountylibrary.com/r/blog%3Aaikido-dev-blog-compromised-flutter-package-on-pub-dev-contains-xcsset-malware.md).
- Telemetry analysis of cloud environments for malicious code in bundles/assets, then tracked expanding package scope [E2](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-widespread-npm-supply-chain-attack-breaking-down-impact-scope-across-debug-chalk.md).
- npm monitoring flagged two anomalies: publish identity deviated from the OIDC pattern to a manual account, and provenance was missing; contents then revealed the postinstall script [E3](https://bugbountylibrary.com/r/blog%3Astepsecurity-io-blog-cline-supply-chain-attack-detected-cline-2-3-0-silently-installs-openclaw.md).

## Variants seen
- Worm on a maintainer's machine injecting build hooks into shipped `example/` files [E1](https://bugbountylibrary.com/r/blog%3Aaikido-dev-blog-compromised-flutter-package-on-pub-dev-contains-xcsset-malware.md).
- Social-engineered account takeover publishing malicious versions of popular packages [E2](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-widespread-npm-supply-chain-attack-breaking-down-impact-scope-across-debug-chalk.md).
- Manual publish via a bot-named human account bypassing OIDC, adding a postinstall installer [E3](https://bugbountylibrary.com/r/blog%3Astepsecurity-io-blog-cline-supply-chain-attack-detected-cline-2-3-0-silently-installs-openclaw.md).

## Impact and severity
High: credential theft and propagation to every project on a machine and to developers who clone and build [E1](https://bugbountylibrary.com/r/blog%3Aaikido-dev-blog-compromised-flutter-package-on-pub-dev-contains-xcsset-malware.md); wallet-address diversion reaching ~10% of cloud environments in a 2-hour window via transitive propagation [E2](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-widespread-npm-supply-chain-attack-breaking-down-impact-scope-across-debug-chalk.md); persistent daemon on ~4,000 machines, chained to a separate takeover CVE and surviving package removal and reboots [E3](https://bugbountylibrary.com/r/blog%3Astepsecurity-io-blog-cline-supply-chain-attack-detected-cline-2-3-0-silently-installs-openclaw.md). Impact rose with transitive reach, persistence, and chaining to another weakness.

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Aaikido-dev-blog-compromised-flutter-package-on-pub-dev-contains-xcsset-malware.md
- E2: https://bugbountylibrary.com/r/blog%3Awiz-io-blog-widespread-npm-supply-chain-attack-breaking-down-impact-scope-across-debug-chalk.md
- E3: https://bugbountylibrary.com/r/blog%3Astepsecurity-io-blog-cline-supply-chain-attack-detected-cline-2-3-0-silently-installs-openclaw.md