--- title: Supply chain worm hits... description: Ten malicious versions of @7nohe/openapi-react-query-codegen (150,000+ weekly downloads) were published to npm on August 28, 2026, in a supply chain attack... canonical: https://daily.dev/posts/supply-chain-worm-hits-7nohe-openapi-react-query-codegen-spreading-through-npm-via-abused-github-a-y3asnolwa twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Supply chain worm hits @7nohe/openapi-react-query-codegen, spreading through npm via abused GitHub Actions workflow | daily.dev og:description: Ten malicious versions of @7nohe/openapi-react-query-codegen (150,000+ weekly downloads) were published to npm on August 28, 2026, in a supply chain attack... og:url: https://daily.dev/posts/supply-chain-worm-hits-7nohe-openapi-react-query-codegen-spreading-through-npm-via-abused-github-a-y3asnolwa og:image: https://api.daily.dev/og/posts/y3ASNOLwa.png og:image:alt: Supply chain worm hits @7nohe/openapi-react-query-codegen, spreading through npm via abused GitHub Actions workflow og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Supply chain worm hits @7nohe/openapi-react-query-codegen, spreading through npm via abused GitHub Actions workflow **[Collections](https://daily.dev/sources/collections)** · 3 min read · 6 upvotes · 3 comments ## Summary Ten malicious versions of @7nohe/openapi-react-query-codegen (150,000+ weekly downloads) were published to npm on August 28, 2026, in a supply chain attack dubbed 'Mini Shai-Hulud'. The attacker exploited a GitHub Actions workflow that could be triggered by commenting 'npm publish' on any pull request, allowing them to publish attacker-controlled code under the repo's trusted OIDC identity — complete with valid npm provenance attestations. The payload, delivered via a binding.gyp file, harvests credentials (GitHub, npm, AWS, Azure, GCP, Kubernetes, SSH keys, .env files, crypto wallets, Claude AI sessions) and spreads as a worm to all packages the victim maintains. Affected versions include 3.0.4 (currently tagged latest). Safe versions are 0.5.3, 1.6.2, 2.2.0, and 3.0.2. The attack highlights that npm provenance only guarantees a package was built by a specific workflow — not that the workflow itself was safe to trigger. ## Content Ten malicious versions of the npm package `@7nohe/openapi-react-query-codegen` were published on August 28, 2026, in what researchers are calling a "Mini Shai-Hulud" supply chain attack. The package is a popular TanStack Query code generator with over 150,000 weekly downloads, so the potential blast radius here is significant. ## How the attacker got in The root cause was a GitHub Actions release workflow that could be triggered by anyone commenting `npm publish` on a pull request — no role check, no approval gate. The workflow would check out the commenter's pull request, install its dependencies, and publish directly to npm using a privileged OIDC identity through npm Trusted Publishing. The attacker submitted a pull request from a fork, left the magic comment, and the workflow did the rest. Because the workflow itself was legitimate, the published packages came with valid npm provenance attestations. Running `npm audit signatures` would show nothing wrong. This is worth sitting with for a moment: the supply chain integrity tooling npm ships by default gave these malicious packages a clean bill of health. ## What the malware does The payload arrives via a `binding.gyp` file or a preinstall script and executes during `npm install` without requiring any explicit preinstall hook. It's a 5.4 MB, four-layer-encrypted JavaScript file. Once running, it: - Downloads the Bun runtime silently - Harvests GitHub tokens (via `gh auth token` and git-credential-manager), npm, PyPI, and RubyGems tokens - Reads AWS, Azure, and GCP credentials, including probing the Google Cloud metadata endpoint - Grabs Kubernetes configs, SSH keys, and `.env` files - Targets crypto wallets and Claude AI session data - Enumerates running processes and SSH/SCP tooling - Spreads to every other package the victim maintains, functioning as a worm Before doing any of this, it checks for Russian locale settings, known security scanner environments, and EDR tools. If it thinks it's being watched, it stays quiet. Aikido Security detected and reported the incident. StepSecurity's Harden-Runner independently reproduced the behavior on isolated runners. ## Affected versions The compromised versions are: `0.5.4`, `0.5.5`, `1.6.3`, `1.6.4`, `2.2.1`, `2.2.2`, `3.0.3`, `3.0.4`, and two prerelease tags. At the time of writing, npm's `latest` tag still pointed to the malicious `3.0.4`. Known-clean versions: `0.5.3`, `1.6.2`, `2.2.0`, `3.0.2`. ## What to do - **Don't install the `latest` tag.** Pin explicitly to a known-clean version. - If you installed any of the affected versions, assume your credentials are compromised and rotate everything: GitHub tokens, npm tokens, cloud credentials, SSH keys. - Isolate any systems where the package was installed. - Check other packages you maintain for signs of the worm spreading. Aikido Security has released an open-source tool called Safe Chain for pre-install package vetting if you want to add a layer of checking to your workflow. ## Questions this post answers ### Which versions of @7nohe/openapi-react-query-codegen are compromised and which are safe to use? Compromised versions are 0.5.4, 0.5.5, 1.6.3, 1.6.4, 2.2.1, 2.2.2, 3.0.3, 3.0.4, and two prerelease tags — with npm's latest tag pointing to the malicious 3.0.4 at the time of disclosure. Known-clean versions are 0.5.3, 1.6.2, 2.2.0, and 3.0.2. Pin explicitly to one of those clean versions and do not rely on the latest tag. _Developers maintaining npm packages track active supply chain incidents like this one on daily.dev._ ### How did the attacker publish malicious packages to npm with valid provenance attestations in the openapi-react-query-codegen attack? The attacker exploited a GitHub Actions release workflow that triggered an npm publish whenever anyone commented 'npm publish' on a pull request, with no role check or approval gate. The workflow checked out the commenter's fork, installed its dependencies, and published using a privileged OIDC identity via npm Trusted Publishing. Because the workflow itself was legitimate, the packages received valid provenance attestations, so npm audit signatures reported nothing wrong. _Teams hardening their CI/CD release pipelines against this class of attack follow the latest findings on daily.dev._ ### What credentials and data does the @7nohe/openapi-react-query-codegen malware steal when installed? The malware harvests GitHub tokens (via gh auth token and git-credential-manager), npm, PyPI, and RubyGems tokens, AWS, Azure, and GCP credentials including the Google Cloud metadata endpoint, Kubernetes configs, SSH keys, .env files, crypto wallet data, and Claude AI session data. It also enumerates running processes and spreads as a worm to every other package the victim maintains. It evades detection by checking for Russian locale settings, known scanner environments, and EDR tools. _Anyone who installed an affected version should rotate all credentials — npm package security incidents like this surface quickly on daily.dev._ ## Community discussion Top comments from developers on daily.dev. **@taiwofrancis** · 2 upvotes > This is scary because the workflow itself was legitimate. One missing permission check was enough to turn it into a supply-chain attack. Really shows how important it is to secure the CI/CD pipeline, not just the code. **@petecapecod** · 0 upvotes > ugh not again 😩 really makes you think though. Something has to change, again. --- Tags: [#security](https://daily.dev/tags/security), [#malware](https://daily.dev/tags/malware), [#github-actions](https://daily.dev/tags/github-actions), [#npm](https://daily.dev/tags/npm) [View this post on daily.dev](https://daily.dev/posts/supply-chain-worm-hits-7nohe-openapi-react-query-codegen-spreading-through-npm-via-abused-github-a-y3asnolwa) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Supply chain worm hits @7nohe/openapi-react-query-codegen, spreading through npm via abused GitHub Actions workflow","url":"https://daily.dev/posts/supply-chain-worm-hits-7nohe-openapi-react-query-codegen-spreading-through-npm-via-abused-github-a-y3asnolwa","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/supply-chain-worm-hits-7nohe-openapi-react-query-codegen-spreading-through-npm-via-abused-github-a-y3asnolwa"},"datePublished":"2026-08-28T22:54:13.093Z","dateModified":"2026-09-13T19:31:45.316Z","description":"Ten malicious versions of @7nohe/openapi-react-query-codegen (150,000+ weekly downloads) were published to npm on August 28, 2026, in a supply chain attack...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/d0853ccb8b9ee109640414222d425c3c?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/d0853ccb8b9ee109640414222d425c3c?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Collections","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Collections","logo":"https://media.daily.dev/image/upload/s--fk_6ycEi--/f_auto,q_auto/v1780996001/logos/collections?_a=BAMAMiWQ0","url":"https://daily.dev/sources/collections"},"commentCount":3,"discussionUrl":"https://daily.dev/posts/supply-chain-worm-hits-7nohe-openapi-react-query-codegen-spreading-through-npm-via-abused-github-a-y3asnolwa","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":6},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":3}],"keywords":"security,malware,github-actions,npm","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Collections","item":"https://daily.dev/sources/collections"},{"@type":"ListItem","position":3,"name":"Supply chain worm hits @7nohe/openapi-react-query-codegen, spreading through npm via abused GitHub Actions workflow"}]} {"@context":"https://schema.org","@type":"WebPage","@id":"https://daily.dev/posts/supply-chain-worm-hits-7nohe-openapi-react-query-codegen-spreading-through-npm-via-abused-github-a-y3asnolwa","comment":[{"@type":"Comment","text":"This is scary because the workflow itself was legitimate. One missing permission check was enough to turn it into a supply-chain attack. Really shows how important it is to secure the CI/CD pipeline, not just the code.","datePublished":"2026-08-29T02:53:27.105Z","url":"https://daily.dev/posts/y3ASNOLwa#c-xJBNQZpIJ","author":{"@type":"Person","name":"Taiwo Francis Oguntade","url":"https://daily.dev/taiwofrancis","image":"https://media.daily.dev/image/upload/s--px3_Pvo4--/f_auto/v1785515368/avatars/avatar_FStpm3ZejUD3qGlEeoOUS?_a=BAMAMicg0"},"interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":2}},{"@type":"Comment","text":"ugh not again 😩 really makes you think though. Something has to change, again.","datePublished":"2026-08-30T12:37:51.514Z","url":"https://daily.dev/posts/y3ASNOLwa#c-Glhmhjc9f","author":{"@type":"Person","name":"Peter Cruckshank","url":"https://daily.dev/petecapecod","image":"https://media.daily.dev/image/upload/s--ZJhQyKws--/f_auto/v1721235024/avatars/avatar_A9xh33q0QoxtkGoJRCosp"}}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/supply-chain-worm-hits-7nohe-openapi-react-query-codegen-spreading-through-npm-via-abused-github-a-y3asnolwa#faq","mainEntity":[{"@type":"Question","name":"Which versions of @7nohe/openapi-react-query-codegen are compromised and which are safe to use?","acceptedAnswer":{"@type":"Answer","text":"Compromised versions are 0.5.4, 0.5.5, 1.6.3, 1.6.4, 2.2.1, 2.2.2, 3.0.3, 3.0.4, and two prerelease tags — with npm's latest tag pointing to the malicious 3.0.4 at the time of disclosure. Known-clean versions are 0.5.3, 1.6.2, 2.2.0, and 3.0.2. Pin explicitly to one of those clean versions and do not rely on the latest tag. Developers maintaining npm packages track active supply chain incidents like this one on daily.dev."}},{"@type":"Question","name":"How did the attacker publish malicious packages to npm with valid provenance attestations in the openapi-react-query-codegen attack?","acceptedAnswer":{"@type":"Answer","text":"The attacker exploited a GitHub Actions release workflow that triggered an npm publish whenever anyone commented 'npm publish' on a pull request, with no role check or approval gate. The workflow checked out the commenter's fork, installed its dependencies, and published using a privileged OIDC identity via npm Trusted Publishing. Because the workflow itself was legitimate, the packages received valid provenance attestations, so npm audit signatures reported nothing wrong. Teams hardening their CI/CD release pipelines against this class of attack follow the latest findings on daily.dev."}},{"@type":"Question","name":"What credentials and data does the @7nohe/openapi-react-query-codegen malware steal when installed?","acceptedAnswer":{"@type":"Answer","text":"The malware harvests GitHub tokens (via gh auth token and git-credential-manager), npm, PyPI, and RubyGems tokens, AWS, Azure, and GCP credentials including the Google Cloud metadata endpoint, Kubernetes configs, SSH keys, .env files, crypto wallet data, and Claude AI session data. It also enumerates running processes and spreads as a worm to every other package the victim maintains. It evades detection by checking for Russian locale settings, known scanner environments, and EDR tools. Anyone who installed an affected version should rotate all credentials — npm package security incidents like this surface quickly on daily.dev."}}]} ```