--- title: Supply chain worm hits... description: Ten malicious versions of @7nohe/openapi-react-query-codegen (150,000+ weekly downloads) were published to npm on August 28, 2026, in a supply chain attack... canonical: https://daily.dev/posts/supply-chain-worm-hits-7nohe-openapi-react-query-codegen-spreading-through-npm-via-abused-github-a-y3asnolwa twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Supply chain worm hits @7nohe/openapi-react-query-codegen, spreading through npm via abused GitHub Actions workflow | daily.dev og:description: Ten malicious versions of @7nohe/openapi-react-query-codegen (150,000+ weekly downloads) were published to npm on August 28, 2026, in a supply chain attack... og:url: https://daily.dev/posts/supply-chain-worm-hits-7nohe-openapi-react-query-codegen-spreading-through-npm-via-abused-github-a-y3asnolwa og:image: https://api.daily.dev/og/posts/y3ASNOLwa.png og:image:alt: Supply chain worm hits @7nohe/openapi-react-query-codegen, spreading through npm via abused GitHub Actions workflow og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Supply chain worm hits @7nohe/openapi-react-query-codegen, spreading through npm via abused GitHub Actions workflow **[Collections](https://daily.dev/sources/collections)** · 3 min read · 1 upvotes · 1 comments ## Summary Ten malicious versions of @7nohe/openapi-react-query-codegen (150,000+ weekly downloads) were published to npm on August 28, 2026, in a supply chain attack dubbed 'Mini Shai-Hulud'. The attacker exploited a GitHub Actions workflow that could be triggered by commenting 'npm publish' on any pull request, allowing them to publish attacker-controlled code under the repo's trusted OIDC identity — complete with valid npm provenance attestations. The payload, delivered via a binding.gyp file, harvests credentials (GitHub, npm, AWS, Azure, GCP, Kubernetes, SSH keys, .env files, crypto wallets, Claude AI sessions) and spreads as a worm to all packages the victim maintains. Affected versions include 3.0.4 (currently tagged latest). Safe versions are 0.5.3, 1.6.2, 2.2.0, and 3.0.2. The attack highlights that npm provenance only guarantees a package was built by a specific workflow — not that the workflow itself was safe to trigger. ## Content Ten malicious versions of the npm package `@7nohe/openapi-react-query-codegen` were published on August 28, 2026, in what researchers are calling a "Mini Shai-Hulud" supply chain attack. The package is a popular TanStack Query code generator with over 150,000 weekly downloads, so the potential blast radius here is significant. ## How the attacker got in The root cause was a GitHub Actions release workflow that could be triggered by anyone commenting `npm publish` on a pull request — no role check, no approval gate. The workflow would check out the commenter's pull request, install its dependencies, and publish directly to npm using a privileged OIDC identity through npm Trusted Publishing. The attacker submitted a pull request from a fork, left the magic comment, and the workflow did the rest. Because the workflow itself was legitimate, the published packages came with valid npm provenance attestations. Running `npm audit signatures` would show nothing wrong. This is worth sitting with for a moment: the supply chain integrity tooling npm ships by default gave these malicious packages a clean bill of health. ## What the malware does The payload arrives via a `binding.gyp` file or a preinstall script and executes during `npm install` without requiring any explicit preinstall hook. It's a 5.4 MB, four-layer-encrypted JavaScript file. Once running, it: - Downloads the Bun runtime silently - Harvests GitHub tokens (via `gh auth token` and git-credential-manager), npm, PyPI, and RubyGems tokens - Reads AWS, Azure, and GCP credentials, including probing the Google Cloud metadata endpoint - Grabs Kubernetes configs, SSH keys, and `.env` files - Targets crypto wallets and Claude AI session data - Enumerates running processes and SSH/SCP tooling - Spreads to every other package the victim maintains, functioning as a worm Before doing any of this, it checks for Russian locale settings, known security scanner environments, and EDR tools. If it thinks it's being watched, it stays quiet. Aikido Security detected and reported the incident. StepSecurity's Harden-Runner independently reproduced the behavior on isolated runners. ## Affected versions The compromised versions are: `0.5.4`, `0.5.5`, `1.6.3`, `1.6.4`, `2.2.1`, `2.2.2`, `3.0.3`, `3.0.4`, and two prerelease tags. At the time of writing, npm's `latest` tag still pointed to the malicious `3.0.4`. Known-clean versions: `0.5.3`, `1.6.2`, `2.2.0`, `3.0.2`. ## What to do - **Don't install the `latest` tag.** Pin explicitly to a known-clean version. - If you installed any of the affected versions, assume your credentials are compromised and rotate everything: GitHub tokens, npm tokens, cloud credentials, SSH keys. - Isolate any systems where the package was installed. - Check other packages you maintain for signs of the worm spreading. Aikido Security has released an open-source tool called Safe Chain for pre-install package vetting if you want to add a layer of checking to your workflow. ## Questions this post answers ### Which versions of @7nohe/openapi-react-query-codegen are compromised and which are safe? Versions published on August 28, 2026 are malicious; the `latest` tag (3.0.4) is compromised. Known-safe versions are 0.5.3, 1.6.2, 2.2.0, and 3.0.2. The attack published ten malicious versions by abusing a GitHub Actions workflow that could be triggered by commenting 'npm publish' on any pull request, giving the attacker valid npm provenance attestations. _Developers depending on this package should pin to a known-safe version — others tracking npm supply chain incidents follow them on daily.dev._ ### Does npm provenance attestation guarantee a package is safe from supply chain attacks? No. npm provenance only guarantees that a package was built by a specific workflow in a specific repository — it says nothing about whether that workflow was abused or whether the code it published was safe. The @7nohe/openapi-react-query-codegen attack passed `npm audit signatures` cleanly because the malicious code was published by a legitimate workflow, just triggered by an attacker. _Maintainers hardening their CI/CD publishing pipelines against this class of attack track real-world cases like this on daily.dev._ ### How did the @7nohe/openapi-react-query-codegen supply chain attack spread to other npm packages? The malware functioned as a worm: once installed on a victim's machine, it spread to every package the victim maintained on npm. The payload arrived via a binding.gyp file that ran Python during npm install, decrypted a four-layer-encrypted JavaScript file, and silently downloaded the Bun runtime to execute it — harvesting tokens, cloud credentials, SSH keys, and crypto wallets in the process. _npm package maintainers watching for worm-style supply chain attacks find incident coverage like this on daily.dev._ ## Community discussion Top comments from developers on daily.dev. **@taiwofrancis** · 0 upvotes > This is scary because the workflow itself was legitimate. One missing permission check was enough to turn it into a supply-chain attack. Really shows how important it is to secure the CI/CD pipeline, not just the code. --- Tags: [#security](https://daily.dev/tags/security), [#malware](https://daily.dev/tags/malware), [#github-actions](https://daily.dev/tags/github-actions), [#npm](https://daily.dev/tags/npm) [View this post on daily.dev](https://daily.dev/posts/supply-chain-worm-hits-7nohe-openapi-react-query-codegen-spreading-through-npm-via-abused-github-a-y3asnolwa) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Supply chain worm hits @7nohe/openapi-react-query-codegen, spreading through npm via abused GitHub Actions workflow","url":"https://daily.dev/posts/supply-chain-worm-hits-7nohe-openapi-react-query-codegen-spreading-through-npm-via-abused-github-a-y3asnolwa","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/supply-chain-worm-hits-7nohe-openapi-react-query-codegen-spreading-through-npm-via-abused-github-a-y3asnolwa"},"datePublished":"2026-08-28T22:54:13.093Z","dateModified":"2026-08-28T23:21:22.177Z","description":"Ten malicious versions of @7nohe/openapi-react-query-codegen (150,000+ weekly downloads) were published to npm on August 28, 2026, in a supply chain attack...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/d0853ccb8b9ee109640414222d425c3c?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/d0853ccb8b9ee109640414222d425c3c?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Collections","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Collections","logo":"https://media.daily.dev/image/upload/s--fk_6ycEi--/f_auto,q_auto/v1780996001/logos/collections?_a=BAMAMiWQ0","url":"https://daily.dev/sources/collections"},"commentCount":1,"discussionUrl":"https://daily.dev/posts/supply-chain-worm-hits-7nohe-openapi-react-query-codegen-spreading-through-npm-via-abused-github-a-y3asnolwa","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":1}],"keywords":"security,malware,github-actions,npm","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Collections","item":"https://daily.dev/sources/collections"},{"@type":"ListItem","position":3,"name":"Supply chain worm hits @7nohe/openapi-react-query-codegen, spreading through npm via abused GitHub Actions workflow"}]} {"@context":"https://schema.org","@type":"WebPage","@id":"https://daily.dev/posts/supply-chain-worm-hits-7nohe-openapi-react-query-codegen-spreading-through-npm-via-abused-github-a-y3asnolwa","comment":[{"@type":"Comment","text":"This is scary because the workflow itself was legitimate. One missing permission check was enough to turn it into a supply-chain attack. Really shows how important it is to secure the CI/CD pipeline, not just the code.","datePublished":"2026-08-29T02:53:27.105Z","url":"https://daily.dev/posts/y3ASNOLwa#c-xJBNQZpIJ","author":{"@type":"Person","name":"Taiwo Francis Oguntade","url":"https://daily.dev/taiwofrancis","image":"https://media.daily.dev/image/upload/s--px3_Pvo4--/f_auto/v1785515368/avatars/avatar_FStpm3ZejUD3qGlEeoOUS?_a=BAMAMicg0"}}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/supply-chain-worm-hits-7nohe-openapi-react-query-codegen-spreading-through-npm-via-abused-github-a-y3asnolwa#faq","mainEntity":[{"@type":"Question","name":"Which versions of @7nohe/openapi-react-query-codegen are compromised and which are safe?","acceptedAnswer":{"@type":"Answer","text":"Versions published on August 28, 2026 are malicious; the `latest` tag (3.0.4) is compromised. Known-safe versions are 0.5.3, 1.6.2, 2.2.0, and 3.0.2. The attack published ten malicious versions by abusing a GitHub Actions workflow that could be triggered by commenting 'npm publish' on any pull request, giving the attacker valid npm provenance attestations. Developers depending on this package should pin to a known-safe version — others tracking npm supply chain incidents follow them on daily.dev."}},{"@type":"Question","name":"Does npm provenance attestation guarantee a package is safe from supply chain attacks?","acceptedAnswer":{"@type":"Answer","text":"No. npm provenance only guarantees that a package was built by a specific workflow in a specific repository — it says nothing about whether that workflow was abused or whether the code it published was safe. The @7nohe/openapi-react-query-codegen attack passed `npm audit signatures` cleanly because the malicious code was published by a legitimate workflow, just triggered by an attacker. Maintainers hardening their CI/CD publishing pipelines against this class of attack track real-world cases like this on daily.dev."}},{"@type":"Question","name":"How did the @7nohe/openapi-react-query-codegen supply chain attack spread to other npm packages?","acceptedAnswer":{"@type":"Answer","text":"The malware functioned as a worm: once installed on a victim's machine, it spread to every package the victim maintained on npm. The payload arrived via a binding.gyp file that ran Python during npm install, decrypted a four-layer-encrypted JavaScript file, and silently downloaded the Bun runtime to execute it — harvesting tokens, cloud credentials, SSH keys, and crypto wallets in the process. npm package maintainers watching for worm-style supply chain attacks find incident coverage like this on daily.dev."}}]} ```