OpenAPI React Query Codegen Compromised in Mini Shai-Hulud npm Supply Chain Attack

Summary

A threat actor compromised the npm package @7nohe/openapi-react-query-codegen, publishing ten malicious versions with valid npm provenance attestations. The compromised package executes code during installation, targeting cloud credentials, package registry secrets, and GitHub Actions secrets, with self-propagation capabilities. The attack exploited a comment-triggered GitHub Actions publishing workflow, allowing an untrusted account to publish code from a fork under the repository's trusted identity.

Full text

Back[Research][Security News]OpenAPI React Query Codegen Compromised in Mini Shai-Hulud npm Supply Chain AttackTen malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.Socket Research TeamAug 28, 2026|15 min readTen malicious versions were published with valid npm provenance after a threat actor abused a comment-triggered GitHub Actions publishing workflow, with the latest release still compromised at the time of writing.The Socket Threat Research Team is investigating an ongoing Mini Shai-Hulud compromise, affecting the npm package @7nohe/openapi-react-query-codegen. On August 28, 2026, ten malicious versions were published in two waves roughly twenty minutes apart, spanning every maintained release line. At the time of writing, all ten remain installable and the latest tag resolves to malicious version 3.0.4. The package receives roughly 150,000 weekly downloads across all versions.The compromised releases execute threat actor-controlled code during installation. A bundled, obfuscated JavaScript loader decrypts and executes a second-stage payload that targets cloud credentials, package registry credentials, GitHub Actions secrets, and AI agent configuration. The payload also contains self-propagation functionality consistent with Mini Shai-Hulud. The Socket Threat Research Team is continuing to analyze the payload, persistence mechanisms, and broader scope of the compromise.Notably, all ten malicious versions carry valid npm provenance attestations issued through GitHub Actions trusted publishing. Our investigation found that a comment-triggered publishing workflow can be invoked by an untrusted GitHub account to publish code from a pull request fork under the repository’s trusted publishing identity.This is an ongoing investigation. The Socket Threat Research Team is continuing to track the Mini Shai-Hulud compromise and analyze the malicious payloads, publishing workflow abuse, and broader scope of activity. We will continue to update this post with additional findings and technical analysis as the investigation evolves.Compromised Packages and Versions#The ten compromised versions of @7nohe/openapi-react-query-codegen are listed below:@7nohe/openapi-react-query-codegen@0.0.0-365d4eb738d3146583431948d3ba6e27a32556be@7nohe/openapi-react-query-codegen@0.0.0-ec7876d6c917dad516ba69bbfafc948b834bf0ab@7nohe/openapi-react-query-codegen@0.5.4@7nohe/openapi-react-query-codegen@0.5.5@7nohe/openapi-react-query-codegen@1.6.3@7nohe/openapi-react-query-codegen@1.6.4@7nohe/openapi-react-query-codegen@2.2.1@7nohe/openapi-react-query-codegen@2.2.2@7nohe/openapi-react-query-codegen@3.0.3@7nohe/openapi-react-query-codegen@3.0.4The attacker republished across every maintained release line. Last known-good version per line: 0.5.3, 1.6.2, 2.2.0, 3.0.2.Overview#Ten versions of the npm package @7nohe/openapi-react-query-codegen were published with malicious code on August 28, 2026, in two waves roughly twenty minutes apart. All ten remain installable at the time of writing, and the latest tag still resolves to the malicious 3.0.4 — a plain npm install [@7nohe/openapi-react-query-codegen](<https://socket.dev/npm/package/@7nohe/openapi-react-query-codegen/overview/3.0.4>) currently retrieves a compromised build.The malicious releases execute a bundled loader, 3FWCvzduYZg.js, at install time. The loader is a ~5.7 MB single-byte-XOR-obfuscated file that decrypts an embedded AES-128-GCM payload, writes it to a random filename in the temp directory, executes it via child_process.execSync, and unlinks it in a finally block.Our subsequent analysis decrypted the second-stage payload, which targets cloud credentials, package registry credentials, GitHub Actions secrets, and AI agent configuration, and contains self-propagation functionality. Analysis of additional payload functionality and persistence mechanisms remains ongoing.All ten versions carry valid npm provenance attestations issued through GitHub Actions trusted publishing.Execution Path#Wave-1 versions execute only through binding.gyp, which is identical across those versions and uses an obfuscated Python expression to reach os.system and run node 3FWCvzduYZg.js. Because binding.gyp is processed by node-gyp during installation, this fires on npm install in developer environments and CI runners.Wave-2 manifests carry the same binding.gyp and additionally add "preinstall": "node 3FWCvzduYZg.js", giving the attacker a second, more reliable execution trigger.The two 0.0.0-* prereleases use different execution paths.0.0.0-365d4eb738d3146583431948d3ba6e27a32556be uses a preinstall script that fetches and runs the Bun installer, then executes is_it_this_simple.js with WORKFLOW_ID=release.yml, REPO_ID_SUFFIX=7nohe/openapi-react-query-codegen, and TARGET_PACKAGES=@7nohe/openapi-react-query-codegen in the environment.0.0.0-ec7876d6c917dad516ba69bbfafc948b834bf0ab follows a separate path. Its preinstall sets the same environment variables but executes node nu.js directly and does not fetch the Bun installer.The threat actor staged these paths across separate commit chains in the fork. One chain adds is_it_this_simple.js before introducing the Bun-based preinstall; the other adds nu.js before introducing and subsequently modifying the corresponding preinstall.Provenance Does Not Help Here#All ten malicious versions carry valid npm provenance attestations issued through GitHub Actions trusted publishing, using the same OIDC configuration as the legitimate 2.2.0 and 3.0.2 releases. Their SLSA predicates name .github/workflows/release.yml on refs/heads/main at resolved commit d42d1733 — the clean v3.0.2 commit — from two Actions runs.The attestations verify successfully while the tarballs contain attacker code. npm audit signatures will not flag these versions. Provenance proves which workflow built an artifact; it does not prove that the workflow only builds trusted source.The Vector: A Comment-Triggered Publish Workflow#There is no pull_request_target workflow in the development repository. release.yml triggers on issue_comment: [created] and gates only on the text of the comment:YAMLif: ${{ github.event_name == 'push' || (github.event.issue.pull_request && github.event.comment.body == 'npm publish') }}The job then checks out the pull request head from the fork (pull/<n>/head), installs dependencies, and runs pnpm publish --no-git-checks with id-token: write.The commenter's repository association is never checked. Any GitHub account can publish a fork's contents under this repository's OIDC identity by commenting npm publish on any pull request. And because GITHUB_REF for issue_comment events is the default branch, the resulting provenance records refs/heads/main at the last legitimate commit — which is exactly why the attestations look clean.Immediate Guidance#For users of the package:Immediately isolate any machine or CI runner that installed an affected version from the network and treat the environment as compromised.Prefer rebuilding affected developer systems and CI runners from a known-clean image. If in-place remediation is necessary, identify and remove malicious persistence before revoking exposed credentials.After the affected environment has been contained, rebuilt, or its persistence neutralized, revoke and rotate all credentials that were accessible from it, including npm tokens, GitHub tokens, cloud credentials, package registry credentials, and CI secrets.Pin @7nohe/openapi-react-query-codegen to a known-good version — 0.5.3, 1.6.2, 2.2.0, or 3.0.2 — and reinstall from a clean lockfile. Clear package-manager caches and remove existing node_modules so a malicious tarball is not reused.Check lockfiles and SBOMs for all ten affected versions, including transitive installations (npm ls @7nohe/openapi-react-query-codegen). Do not rely on npm audit signatures alone: the malicious releases carry valid npm provenance attestations.For maintainers runni

Indicators of Compromise

• malware — Mini Shai-Hulud
• hash_sha256 — b49afb7dba04cd99b357ce7c652c823a3707f28e130bd5c6645851a7adc030d6
• hash_sha256 — 59370c67b54a0ccaedd265e2356f04540b2fba1e1845300ef6de4d5437d99380
• hash_sha256 — d3246926b20a8d021ed7de0ac8e9eee1dda986088f84ba18f31cb2042a121f5d
• url — https://api.github.com/search/commits
• url — https://registry.npmjs.org/
• url — https://upload.pypi.org/legacy/
• url — https://rubygems.org/

Entities