Version 5.8.3 of the npm package @subql/common was published through a hijacked release workflow that replaced the legitimate build with a malicious artifact. The payload harvests credentials and secrets from local files, CI runner memory and cloud secret stores, injects a workflow into GitHub repositories reachable with a stolen token, and opens a remote command channel to an external server. Version 5.8.2 and earlier are not affected.