@subql/common 5.8.3 npm compromise: CI artifact swap

Not stated.

Root cause: Per StepSecurity: a commit on a short-lived branch added a release-workflow step that, after the build, deleted packages/common and replaced it with an unverified tarball downloaded from ci-artifacts.dev, which the project's publish step then shipped.

Timeline, as sourced: 5 Oct 2026; malicious 5.8.3 published 11:56:29 UTC (per StepSecurity).

On 5 October 2026, version 5.8.3 of @subql/common, a shared library in the SubQuery indexing framework for Web3 applications, was published to npm with a hidden payload. StepSecurity's analysis (opens in a new tab) traces the release to a commit on a temporary branch that added a workflow step: after the build, it removed packages/common and replaced it with a tarball downloaded from ci-artifacts.dev, with no hash or signature check, before the publish step ran. The payload starts on install and on import, collects local credentials, wallet paths and CI secrets, and supports remote shell access. GitHub lists the release as malware in GHSA-9333-3c4x-x3h5 (opens in a new tab). StepSecurity advises excluding 5.8.3 from dependency resolution, blocking ci-artifacts.dev and rotating any credentials reachable from affected hosts.