npm's trusted-publishing pipeline just proved provenance can lie: DPRK slipped a loader past it. https://intel.threadlinqs.com/threat/TL-2026-2588 #ThreatIntel #GHAPPIER #PolinRider #BeaverTail

"GHAPPIER - One loader, sixty-five repositories, twenty-two accounts: an unreported loader family beside DPRK's PolinRider campaign" published by CloudSEK. #GitHub, #NPM, #PolinRider, #NullReceiver, #GHAPPIER https://www.cloudsek.com/blog/ghappier-malware-loader-npm-supply-chain-attack