StepSecurity says its AI Package Analyst flagged @subql/common 5.8.3 on October 5. Subsequent analyst investigation verified registry integrity, compared releases and statically decoded a credential-stealing payload. The distinction is a model alert followed by artifact validation, not an autonomously proven compromise. Investigation. Mechanism,…
Inspect the ClaimsCase · DiggingBeagle record
AI package triage led to a confirmed malicious SubQuery release investigation
Assessment profile
Assessment method- Setting
- production
- Exploitation
- confirmed in the wild
- Evidence
- Grade B
- Remediation
- mitigation available
- AI role
- WITH AI
Basis and provenance
CLM-SUBQUERY-AI-DETECTION-1 reports: The malicious code ran on installation and import; StepSecurity traced external artifact substitution into legitimate publishing and found no recovered payload in the two adjacent releases it compared. Source SRC-2026-CP17-SUBQUERY-AI-ANALYST is located at 'Opening findings; version comparison; Publication Timeline; workflow analysis'. The distinctive mechanism begins: StepSecurity's AI Package Analyst initially flagged @subql/common 5.8.3, after which researchers downloaded the npm archive, compared it with neighboring releases and traced its publication provenance. Classification: setting=production, exploit_status=confirmed_in_the_wild, evidence_grade=B on the bounded original investigator/vendor or paper evidence, without independent dynamic replication. remediation_status=mitigation_available; scoped control or limit: Exclude the compromised 5.8.3 dependency through lockfiles and resolver policy, investigate hosts where install scripts or import executed, and rotate accessible credentials. Blocking only npm install scripts is insufficient when the package's import path activates the payload. The null impact band avoids an ungrounded cross-Case severity rating; observed damage, targeted population and controlled test outcomes cannot be exchanged as the same quantity. Where a patch is described, its availability is separate from independently tested effectiveness.
Assessed Oct 23, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-SUBQUERY-AI-DETECTION-1 · StepSecurity: SubQuery 5.8.3 package investigation
At a glance
Maintainer-account control and successful credential theft from specific downstream systems are not established.
Limits and uncertaintyFull account
StepSecurity says its AI Package Analyst flagged @subql/common 5.8.3 on October 5. Subsequent analyst investigation verified registry integrity, compared releases and statically decoded a credential-stealing payload. The distinction is a model alert followed by artifact validation, not an autonomously proven compromise. Investigation.
Mechanism, preconditions and effects. StepSecurity's AI Package Analyst initially flagged @subql/common 5.8.3, after which researchers downloaded the npm archive, compared it with neighboring releases and traced its publication provenance. The malicious code ran both during install and on import. The legitimate-looking release job fetched an unverified archive from an external mirror immediately before publish, so the signed build record could describe the publishing workflow without certifying the substituted artifact contents.
Comparison and evidence limits. The AI tool supplied a lead, not proof of maliciousness by itself; independent package and workflow inspection established the payload. StepSecurity identified nineteen potentially reachable latest package versions in a registry dependency sample, not nineteen known compromised installations. An unchanged parent version can still accept the patch release through a permitted semver range.
Timeline
- Oct 5, 2026occurrence
Occurrence began
Claims & evidence
CLM-SUBQUERY-AI-DETECTION-1The malicious code ran on installation and import; StepSecurity traced external artifact substitution into legitimate publishing and found no recovered payload in the two adjacent releases it compared.supported
Basis: reported finding
- supportsStepSecurity: SubQuery 5.8.3 package investigationprimary disclosure
Opening findings; version comparison; Publication Timeline; workflow analysis
Controls and mitigations
- Exclude the compromised 5.8.3 dependency through lockfiles and resolver policy, investigate hosts where install scripts or import executed, and rotate accessible credentials. Blocking only npm install scripts is insufficient when the package's import path activates the payload.
Unknowns and contradictions
- Maintainer-account control and successful credential theft from specific downstream systems are not established.
Sources and citation
Material revision history
- Oct 23, 2026 · Canonical change recorded · new in release · revision 183