SubQuery: Evidence and scope
Expanded web report · Related PDF snapshot: 22 October 2026 · PDF page 16
Research reviewed 22 October 2026 · Evidence and editorial planning guidance are distinguished below.
What the source establishes
StepSecurity’s investigation describes a malicious @subql/common package and credential-access behavior in the release path. It examines distributed artifacts and their provenance rather than relying only on repository source. The relevant exposure is package installation or execution in a particular environment.
Research reviewed 22 October 2026: StepSecurity SubQL ecosystem investigation. Original package investigation revisited.
Where the evidence stops
A registry download count is not a count of compromised organizations. A valid artifact hash proves identity against that reference, not that the referenced contents are safe.
Use this report as a dated interpretation. A vendor notice establishes what that vendor reports; a research observation establishes what the researcher observed. Neither automatically answers the account-specific question for your business. Record later changes to the source before relying on its versions, deadlines or recovery sequence.
Establish your own scope
Use lockfiles and build evidence to identify exact artifacts and transitive paths. Establish where installation or execution occurred and which repository, publishing, cloud or service credentials were available there.
- Identify the exact service, artifact, account or device relevant to your business, with a responsible owner.
- Record whether the source applies to that asset and what evidence supports the match.
- Separate evidence of exposure, evidence of activity and evidence of business impact. Leave unanswered questions explicitly open.
What would change the assessment?
Demonstrate the dependency path is removed or remediated, verify replacement build outputs and test revoked access. Record which distributed products were reviewed and how their integrity was assessed.
Revisit the decision when the provider changes scope, a new account-specific notice arrives or local evidence contradicts the current assumption. Preserve the earlier conclusion and the reason it changed. Do not silently turn a precaution into a confirmed breach, or an absence of telemetry into proof of safety.
Decision checkpoint
Authorize releases only when the build environment, publishing identity and resulting artifacts have sufficient evidence of integrity.