Preliminary research

Software Supply Chain Attack on @subql/common: Overview and Response Guidance

AI-collected research leads through 3 November 2026, including a November–October–September missed-article review and a targeted multilingual search alongside earlier community-source sweeps. Unranked, incomplete, not community-vetted, and subject to change.

Reconstructs the @subql/common compromise from workflow tampering to package execution, distinguishing active credential theft from unused embedded tools. Explains why disabling install scripts misses import-time execution and why trusted-publisher identity or provenance alone cannot establish package safety.

Record

Published by

GMO Flatt Security Research

Date

6 October 2026

In the archive

• Collected in the 2026 preliminary research sweep

Related sources

• Original Japanese edition
• Earlier incident analysis

Tags

• npm
• supply-chain
• github-actions
• oidc
• provenance
• malware-analysis
• incident-response
• owasp-a06-2021
• owasp-a08-2021

This page is the archive's own catalogue record. The research is the work of GMO Flatt Security Research, first published at the original source. Preserved copies are kept so the citation survives its host.