--- title: @7nohe/openapi-react-query-codegen Compromised Through... description: Ten malicious versions of the npm package @7nohe/openapi-react-query-codegen were published after an attacker exploited an exposed GitHub Actions release... canonical: https://daily.dev/posts/7nohe-openapi-react-query-codegen-compromised-through-an-exposed-npm-publishing-workflow-bgbjtyydx twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: @7nohe/openapi-react-query-codegen Compromised Through an Exposed npm Publishing Workflow | daily.dev og:description: Ten malicious versions of the npm package @7nohe/openapi-react-query-codegen were published after an attacker exploited an exposed GitHub Actions release... og:url: https://daily.dev/posts/7nohe-openapi-react-query-codegen-compromised-through-an-exposed-npm-publishing-workflow-bgbjtyydx og:image: https://api.daily.dev/og/posts/BGbjtyYdx.png og:image:alt: @7nohe/openapi-react-query-codegen Compromised Through an Exposed npm Publishing Workflow og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # @7nohe/openapi-react-query-codegen Compromised Through an Exposed npm Publishing Workflow **[StepSecurity](https://daily.dev/sources/stepsecurity)** · 6 min read · 0 upvotes · 0 comments ## Summary Ten malicious versions of the npm package @7nohe/openapi-react-query-codegen were published after an attacker exploited an exposed GitHub Actions release workflow that accepted an 'npm publish' comment from any pull request participant without verifying their role. The workflow checked out the attacker's pull request, installed its dependencies, and published through npm Trusted Publishing with a privileged OIDC identity. Malicious versions used a preinstall hook or a poisoned binding.gyp path to run an obfuscated payload that downloaded Bun, attempted to read GitHub credentials via gh auth token and git-credential-manager, probed the Google Cloud metadata endpoint, and enumerated processes and SSH/SCP tooling. StepSecurity's Harden-Runner reproduced and observed this behavior on isolated runners. Affected versions include 0.5.4, 0.5.5, 1.6.3, 1.6.4, 2.2.1, 2.2.2, 3.0.3, 3.0.4, and two prerelease tags; at publication time npm 'latest' still pointed to the malicious 3.0.4. Users are urged to avoid installing the latest tag, pin to known-clean versions (0.5.3, 1.6.2, 2.2.0, or 3.0.2), isolate affected systems, and rotate all potentially exposed credentials. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Is it safe to install @7nohe/openapi-react-query-codegen right now? No, installing the latest tag is unsafe because npm still mapped it to the malicious version 3.0.4 at the time of disclosure. Ten compromised versions were published (0.5.4, 0.5.5, 1.6.3, 1.6.4, 2.2.1, 2.2.2, 3.0.3, 3.0.4, and two prerelease tags), each running attacker code via a malicious preinstall hook or binding.gyp path. Pin to a known-clean version instead: 0.5.3, 1.6.2, 2.2.0, or 3.0.2. _Track npm supply chain incidents like this one on daily.dev before pinning dependency versions._ ### How did the attacker publish malicious versions of openapi-react-query-codegen without stealing npm credentials? The attacker exploited a GitHub Actions release workflow that triggered on an issue_comment event and only checked that a comment body exactly matched 'npm publish' on a pull request, without verifying the commenter's role or association. This let an external contributor's pull request get checked out, installed with pnpm, and published through npm Trusted Publishing using a privileged OIDC identity with id-token write access. _Developers hardening CI/CD release pipelines can follow supply chain security coverage on daily.dev._ ### What does the malicious preinstall payload in openapi-react-query-codegen 3.0.4 actually do? It runs a 6.38MB obfuscated file named 3FWCvzduYZg.js that decodes XOR-encoded code through the JavaScript Function constructor, then downloads and executes a Bun binary from a temporary /tmp/trinnyyyy- directory. That staged Bun process runs gh auth token and git-credential-manager to grab GitHub credentials, probes the Google Cloud metadata endpoint, checks for SSH/SCP tooling, and enumerates running processes. _daily.dev surfaces malware analysis breakdowns like this for developers auditing dependency risk._ ## Similar posts on daily.dev - [Multiple redhat-cloud-services npm packages compromised \(StepSecurity Blog\)](https://daily.dev/posts/multiple-redhat-cloud-services-npm-packages-compromised-stepsecurity-blog--prno3btx5) · LWN.net · 0 upvotes · 0 comments --- Tags: [#cyber](https://daily.dev/tags/cyber), [#malware](https://daily.dev/tags/malware), [#github-actions](https://daily.dev/tags/github-actions), [#npm](https://daily.dev/tags/npm) [View this post on daily.dev](https://daily.dev/posts/7nohe-openapi-react-query-codegen-compromised-through-an-exposed-npm-publishing-workflow-bgbjtyydx) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"@7nohe/openapi-react-query-codegen Compromised Through an Exposed npm Publishing Workflow","url":"https://daily.dev/posts/7nohe-openapi-react-query-codegen-compromised-through-an-exposed-npm-publishing-workflow-bgbjtyydx","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/7nohe-openapi-react-query-codegen-compromised-through-an-exposed-npm-publishing-workflow-bgbjtyydx"},"datePublished":"2026-08-28T23:20:00.298Z","dateModified":"2026-08-28T23:21:09.588Z","description":"Ten malicious versions of the npm package @7nohe/openapi-react-query-codegen were published after an attacker exploited an exposed GitHub Actions release...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/fea9062a9b63bc903bc7da9c05ed8a5c?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/fea9062a9b63bc903bc7da9c05ed8a5c?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"StepSecurity","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"StepSecurity","logo":"https://media.daily.dev/image/upload/s--vegWii-S--/f_auto,q_auto/v1774959924/logos/stepsecurity?_a=BAMAMiWQ0","url":"https://daily.dev/sources/stepsecurity"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/7nohe-openapi-react-query-codegen-compromised-through-an-exposed-npm-publishing-workflow-bgbjtyydx","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"cyber,malware,github-actions,npm","timeRequired":"PT6M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"StepSecurity","item":"https://daily.dev/sources/stepsecurity"},{"@type":"ListItem","position":3,"name":"@7nohe/openapi-react-query-codegen Compromised Through an Exposed npm Publishing Workflow"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/7nohe-openapi-react-query-codegen-compromised-through-an-exposed-npm-publishing-workflow-bgbjtyydx#faq","mainEntity":[{"@type":"Question","name":"Is it safe to install @7nohe/openapi-react-query-codegen right now?","acceptedAnswer":{"@type":"Answer","text":"No, installing the latest tag is unsafe because npm still mapped it to the malicious version 3.0.4 at the time of disclosure. Ten compromised versions were published (0.5.4, 0.5.5, 1.6.3, 1.6.4, 2.2.1, 2.2.2, 3.0.3, 3.0.4, and two prerelease tags), each running attacker code via a malicious preinstall hook or binding.gyp path. Pin to a known-clean version instead: 0.5.3, 1.6.2, 2.2.0, or 3.0.2. Track npm supply chain incidents like this one on daily.dev before pinning dependency versions."}},{"@type":"Question","name":"How did the attacker publish malicious versions of openapi-react-query-codegen without stealing npm credentials?","acceptedAnswer":{"@type":"Answer","text":"The attacker exploited a GitHub Actions release workflow that triggered on an issue_comment event and only checked that a comment body exactly matched 'npm publish' on a pull request, without verifying the commenter's role or association. This let an external contributor's pull request get checked out, installed with pnpm, and published through npm Trusted Publishing using a privileged OIDC identity with id-token write access. Developers hardening CI/CD release pipelines can follow supply chain security coverage on daily.dev."}},{"@type":"Question","name":"What does the malicious preinstall payload in openapi-react-query-codegen 3.0.4 actually do?","acceptedAnswer":{"@type":"Answer","text":"It runs a 6.38MB obfuscated file named 3FWCvzduYZg.js that decodes XOR-encoded code through the JavaScript Function constructor, then downloads and executes a Bun binary from a temporary /tmp/trinnyyyy- directory. That staged Bun process runs gh auth token and git-credential-manager to grab GitHub credentials, probes the Google Cloud metadata endpoint, checks for SSH/SCP tooling, and enumerates running processes. daily.dev surfaces malware analysis breakdowns like this for developers auditing dependency risk."}}]} ```