OpenAPI React Query Codegen Compromised in Mini Shai-Hulud npm Supply Chain Attack

Attackers compromised the widely-used npm package @7nohe/openapi-react-query-codegen by exploiting a poorly scoped GitHub Actions workflow that allowed untrusted fork contributors to trigger package publishing under the legitimate repository's trusted identity. Ten malicious versions were published with valid npm provenance attestations, creating a false sense of legitimacy and bypassing common trust signals. The malicious code executed at install time, targeting high-value secrets including cloud credentials, package registry tokens, and GitHub Actions secrets — and was capable of self-propagation. This attack illustrates how CI/CD pipeline misconfigurations can be weaponized to undermine even signed, attested software supply chains.