A comment-triggered Actions workflow published ten malicious npm versions with valid provenance

Trusted publishing swaps a long-lived npm token for a short-lived OIDC credential the workflow receives at run time. The attestation that comes out the far end can say that a run in that repository produced this tarball. It cannot say anything about the diff that run compiled. Socket reports the publish job could be invoked by a comment from an untrusted GitHub account, checking out code from a fork pull request and publishing it under the repository's trusted publishing identity ^[5]. Point that job at attacker code and the signature it produces is perfectly truthful about a build nobody asked for.

The execution paths are worth reading in order. Wave-1 versions run only through `binding.gyp`, which is identical across them and uses an obfuscated Python expression to reach `os.system` and launch `node 3FWCvzduYZg.js`; because node-gyp processes that file during installation, it fires on `npm install` in developer environments and CI runners ^[8]. So a reviewer diffing `package.json` between 0.5.3 and 0.5.4 sees no lifecycle script and nothing to object to. Wave-2 manifests keep the same `binding.gyp` and add `"preinstall": "node 3FWCvzduYZg.js"` on top, a second way in ^[9].

The loader itself is about 5.7 MB, obfuscated with a single-byte XOR, and decrypts an embedded AES-128-GCM payload that it writes to a random filename in the temp directory, executes via `child_process.execSync`, and unlinks in a `finally` block ^[6]. A 5.7 MB blob in a code generator's tarball is not subtle, but nobody reads tarballs. The `finally` matters more than the encryption: the artifact is removed whether or not the child process succeeded, so a responder who arrives late finds an empty temp directory. Socket decrypted the second stage and reports it targets cloud credentials, package registry credentials, GitHub Actions secrets and AI agent configuration, and carries self-propagation ^[7].

Cleanup is not one pin. Of the ten published versions, eight are two consecutive releases on each of four maintained lines, plus two `0.0.0-<commit hash>` prereleases ^[13]. The last known-good release on each line is exactly one patch below the first malicious one there, so 0.5.3, 1.6.2, 2.2.0 and 3.0.2 are four separate downgrades depending on which line a given service is on ^[14]. Meanwhile the `latest` tag still resolved to 3.0.4 at the time of writing ^[3].

Provenance is good engineering for the thing it was built for, which is binding an artifact to a build log you can go read. What would have to be true for a valid attestation to also function as a trust gate is that the set of people who can trigger the attested build equals the set of people you trust to write the code. Socket says that is not the case here ^[5]. The number I cannot get from this report is exposure: 150,000 weekly downloads across all versions ^[2] tells you nothing about how many resolved to the ten bad ones in the window before detection.