Notifications
Clear all
Topic starter
19/08/2026 3:44 pm
TL;DR: A hijacked verified GitHub organisation was used to host malicious Polymarket trading bots that hid typosquatted npm packages, exfiltrated wallet keys and configuration files, and installed an SSH backdoor during installation and runtime, according to StepSecurity. The case shows how trusted open-source infrastructure can be repurposed into a supply-chain delivery path for NHI and developer secrets.
NHIMG editorial — based on content published by StepSecurity covering the hijacked dev-protocol GitHub organisation and malicious Polymarket bot campaign
By the numbers:
- The dev-protocol GitHub organisation had 568 followers before it was repurposed to distribute malicious trading bots.
Questions worth separating out
Q: What breaks when npm package installation is allowed to execute lifecycle scripts by default?
A: A malicious dependency can run code before installation completes, which turns normal package resolution into a payload delivery mechanism.
Q: Why do verified GitHub organisations still pose supply-chain risk?
A: Verification and history can create false confidence, but they do not prove the current maintainer is trustworthy or that every new repository is legitimate.
Q: How should security teams handle leaked secrets across developer workflows?
A: Treat every leaked secret as an identity incident, not just a code hygiene issue.
Practitioner guidance
- Ban trusted-by-default package execution Require explicit approval for npm install scripts in untrusted repositories and use --ignore-scripts for new or externally sourced code.
- Separate wallet keys from developer files Remove wallet private keys and API secrets from .env, id.json, and config files on developer machines and CI runners.
- Watch for SSH state changes in runners Alert on modifications to ~/.ssh/authorized_keys, unexpected sudo use, and firewall changes such as opening port 22 during builds.
What's in the full article
StepSecurity's full blog post covers the operational detail this post intentionally leaves for the source:
- The full process tree showing how npm install spawned the malicious postinstall hook and privileged shell commands.
- The decoded package behaviour behind levex-refa and lint-builder, including file search patterns and exfiltration endpoints.
- The exact GitHub Actions victim simulation and Harden-Runner telemetry used to confirm the attack chain in real time.
- The repository indicators of compromise, including malicious package names, domain indicators, and suspicious account patterns.
👉 Read StepSecurity’s analysis of the hijacked dev-protocol org and wallet-key theft →
Hijacked GitHub orgs and malicious npm bots: what should teams do?
Explore further
19/08/2026 4:22 pm
Repository reputation is now an identity control, not a cosmetic signal. A verified badge, follower count, and old repository history can no longer be treated as sufficient evidence of trust. Attackers are exploiting the human tendency to equate social proof with software safety, which means developer platform governance now sits inside the broader identity boundary. Practitioners should treat repository ownership changes and maintainer continuity as access events, not just metadata.
A few things that frame the scale:
- 85% of organisations lack full visibility into third-party vendors connected via OAuth apps, according to The State of Non-Human Identity Security.
- Lack of credential rotation is cited as the top cause of NHI-related attacks by 45% of organisations, followed by inadequate monitoring and logging at 37% and over-privileged accounts at 37%.
A question worth separating out:
Q: Who is accountable when a malicious package steals wallet keys from a developer machine?
A: Accountability usually spans software engineering, platform security, and identity governance because the failure crosses code provenance, secret storage, and execution policy. Organisations should map ownership for dependency approval, local secret handling, CI runner hardening, and incident response so that a package compromise cannot sit outside any control domain.
👉 Read our full editorial: Hijacked GitHub orgs are turning npm bots into wallet-key stealers
