@subql/common 5.8.3 compromised on npm (SubQuery, Oct 5 2026): credential stealer pulled in through @subql/cli, @subql/node, @subql/query and other @subql packages. Am I affected and what do I rotate?

What happened: on October 5, 2026 a malicious @subql/common 5.8.3 was published to npm. The attacker changed SubQuery's GitHub release workflow so that, just before publishing, it swapped the package's built files for an archive downloaded from an outside server (ci-artifacts.dev) with no hash check. The bad release runs its payload both from a postinstall hook and when the package is imported, so turning off npm install scripts alone doesn't protect you. The payload collects credentials from developer machines and CI jobs and supports remote shell access. Because many @subql packages depend on @subql/common with a version range, you could get 5.8.3 without listing it yourself. Am I affected: - Your lockfile resolves @subql/common to 5.8.3: npm ls @subql/common, or search package-lock.json / yarn.lock / pnpm-lock.yaml. Packages that could pull it in include @subql/cli 6.6.3, @subql/node-core 19.3.1, @subql/query 2.25.0, @subql/node-ethereum 6.5.0, @subql/node 6.4.6, @subql/node-solana 6.3.5 and @subql/node-starknet 6.1.0 (at least 19 @subql packages in total). - Indicators: a file dist/project/readers/manifest-cache.js inside the installed @subql/common, a lock file named like tmp.ts018051808.lock, and network connections to ci-artifacts.dev. - 5.8.2 and earlier are reported clean. Fix: 1. Pin @subql/common to 5.8.2 (or a later version the maintainers confirm clean) with npm overrides / yarn resolutions / pnpm overrides, delete node_modules, reinstall from the corrected lockfile, and rebuild containers and CI caches. 2. On every machine, runner or container that installed or ran 5.8.3, rotate: npm tokens (.npmrc), GitHub tokens, AWS and other cloud credentials, SSH keys, kubeconfigs and Kubernetes service account tokens, HashiCorp Vault tokens, and AI tool API keys and configs. Rebuild ephemeral CI runners. 3. Block ci-artifacts.dev and check logs for connections to it. After: review cloud, GitHub and npm audit logs since October 5 for activity you didn't do, and in your own release pipelines don't download build artifacts from outside sources without pinning a checksum. Sources: https://www.stepsecurity.io/blog/subql-ecosystem-compromised https://linuxsecurity.com/news/security-vulnerabilities/subquery-supply-chain-attack https://www.mend.io/vulnerability-database/MSC-2026-12672/