Threat video1:00
GHAPPIER npm dforge-mcp 0.2.21 Loader: Detection & IOCs
GHAPPIER rode a valid-provenance npm release of dforge-mcp 0.2.21 into MCP launches. Its 14 IOCs map to 9 detection rules, including a free Splunk SPL rule.
Read the full threat intel for GHAPPIER npm dforge-mcp 0.2.21 Loader: Detection & IOCs →
Chapters
- 0:00The hookCloudSEK reports a loader in 73 infected files.
- 0:05The storyAn attacker used maintainer access for 105 minutes.
- 0:12Attack pathCloudSEK reports someone had push access.
- 0:28AttributionNo threat actor is attributed.
- 0:32Indicators of compromise6 indicators to hunt: 2 file names, 3 package names and 1 path.
- 0:38MITRE ATT&CK techniques11 ATT&CK techniques, from initial access to command and control.
- 0:43Remediation11 remediation steps are listed, 4 of them immediate.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00CloudSEK reports a loader in 73 infected files.
0:05An attacker used maintainer access for 105 minutes.
0:10It published a loader.
0:12CloudSEK reports someone had push access.
0:15A loader entered the package.
0:17Malicious 0.2.21 passed npm's provenance check.
0:22Launching the server ran a remote shell.
0:24It deletes itself from disk.
0:28No threat actor is attributed. Confidence: low.
0:336 indicators to hunt: 2 file names, 3 package names and 1 path.
0:3911 ATT&CK techniques, from initial access to command and control.
0:4411 remediation steps are listed, 4 of them immediate.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.