Self-Spreading npm Worm Compromises 58 GitHub Repositories
A self-spreading npm worm utilized stolen GitHub tokens to inject malicious code into 58 repositories, affecting both local environments and Laravel Forge…
On October 21, a self-spreading npm worm pushed forged commits to 58 repositories across one developer account and roughly a dozen organizations in about 20 minutes using a GitHub token stolen from a collaborator's machine.
The attack matches PolinRider, also known as ChainVeil or ViteVenom. The worm rewrote recent commits while keeping the original author and date, but the committer name was cut to its first word and the timezone was set to -07:00. In Laravel projects, it also executed on Laravel Forge servers during automatic deployments, placing a remote-control agent under ~/.node_modules/ on two servers that read every .env file under /home/forge.
The forged commits added .vscode/tasks.json and .vscode/settings.json for automatic execution on folder open, obfuscated JavaScript disguised as a font file named public/fonts/fa-solid.lfk, a root-level api.js hooked into package.json, loaders hidden in Vite, PostCSS or Tailwind configs, a dropper call in artisan, and .gitignore entries for files like branch_structure.json and temp_auto_push.bat.
Cleanup required resetting Forge checkouts explicitly with git reset --hard, revoking GitHub OAuth tokens stored in Git remote URLs, and running parallel Claude Code sessions to match forged commits to clean originals and restore branches with signed corrective commits. You can check repositories using git log --format='%h %an | %cn | %cd' -20 to spot unusual timezones or committer names, and search for folderOpen tasks, .lfk files, root-level api.js, and modified build configs or artisan files.