SubQuery

Version 5.8.3 of the Subql/common package, part of the widely used SubQuery project with around 18,000 GitHub stars, has been compromised and contains a credential-stealing script that runs automatically on install via its postinstall hook. The issue was flagged publicly on the project's GitHub repository, and developers are being warned to avoid installing the affected version while the supply-chain attack is investigated.