Malicious npm Package Steals GitHub, Cloud, and CI/CD Secrets and Spreads to Other Packages

A supply-chain compromise affecting the popular npm package @7nohe/openapi-react-query-codegen is exposing developer workstations and CI/CD runners to a credential-stealing, self-propagating payload.

On August 28, 2026, attackers published ten malicious versions across every maintained release branch of the OpenAPI-to-TanStack Query code generator, which records roughly 150,000 weekly downloads.

The releases appeared in two publishing waves approximately 20 minutes apart. At the time Socket published its analysis, the npm latest tag resolved to compromised version 3.0.4, meaning a standard installation could retrieve the malicious package.

The affected versions are 0.5.4, 0.5.5, 1.6.3, 1.6.4, 2.2.1, 2.2.2, 3.0.3, 3.0.4, plus two malicious 0.0.0-* prereleases. Known-clean versions are 0.5.3, 1.6.2, 2.2.0, and 3.0.2.

The stable poisoned packages include a large obfuscated JavaScript loader, 3FWCvzduYZg.js, designed to run during installation.

Wave-one releases abused binding.gyp a native build configuration file to execute the loader through the node-gyp build path.

Wave-two packages added an explicit preinstall script as a second execution mechanism, making the malware more likely to run on developer endpoints and automated build systems.

The loader decrypts an embedded second-stage payload, writes it under a randomized temporary filename, executes it, and attempts to remove the dropped file afterward.

Researchers found that the payload can download Bun as part of its execution chain, a behavior seen in prior Mini Shai-Hulud activity.

Once active, the malware searches source trees, environment variables, process memory, cloud metadata services, and CI/CD contexts for high-value secrets.

Its targets include GitHub personal access tokens, npm credentials, PyPI and RubyGems tokens, JFrog credentials, AWS keys, Azure identities, Google Cloud credentials, HashiCorp Vault tokens, Kubernetes material, and GitHub Actions secrets.

The incident is more serious than a conventional npm token stealer because the payload can validate recovered credentials and reuse them to compromise other software supply-chain assets.

Malicious npm Package, tracked by Socket as a Mini Shai-Hulud incident, abused a GitHub Actions publishing workflow to release attacker-controlled builds carrying valid npm provenance attestations.

It can identify npm, JFrog, and RubyGems credentials with publishing permissions, retrieve package artifacts, inject malicious code, and republish poisoned versions under victim-controlled namespaces or registries.

It also contains an optional PyPI typosquatting capability, increasing the campaign’s potential cross-ecosystem reach.

npm Supply Chain Attack

The malware further targets GitHub repositories where stolen tokens allow write access.

Researchers say it can modify GitHub Actions workflows, including deployment-triggered workflows designed to serialize repository secrets and upload them as build artifacts.

The payload also supports SSH-based propagation to reachable hosts, turning a compromised developer environment into a potential launching point for lateral movement.

It includes persistence mechanisms for macOS and Linux, including LaunchAgents and user-level systemd services.

Socket also identified code that tampers with AI-development-tool and Model Context Protocol configuration locations, targeting products and files associated with Claude, Codex, Copilot, Cursor, Windsurf, Cline, Aider, Gemini, and other developer assistants.

A key finding is that all ten malicious packages carry valid npm provenance attestations created via GitHub Actions-trusted publishing.

This makes the incident a warning that signed provenance is not sufficient when the release workflow itself can build untrusted code.

The vulnerable release.yml workflow ran on issue_comment events and accepted a pull-request comment containing npm publish as its publication condition.

It then checked out the pull request’s head from a fork and ran pnpm publish –no-git-checks with id-token: write permission.

Because the workflow did not verify the commenter’s repository association, an untrusted GitHub user could trigger publication of fork-controlled content under the project’s legitimate OIDC identity.

The resulting attestations appeared valid because GitHub records the default branch reference for the comment event, rather than proving that the artifact originated solely from reviewed, trusted repository content.

As a result, npm audit signature checks may not flag the malicious packages.

Organizations should treat any workstation or CI runner that installed an affected version as compromised.

Isolate the system from the network first, rebuild it from a known-clean image where possible, then revoke and rotate all accessible GitHub, npm, cloud, registry, SSH, and CI/CD credentials from a separate clean environment.

Teams should remove the dependency, clear package-manager caches and node_modules, regenerate lockfiles, and pin only a known-good version.

Defenders should also examine lockfiles and SBOMs for direct or transitive installations, hunt for binding.gyp and 3FWCvzduYZg.js, and review repository commits, npm publish history, CI workflows, deployments, and newly created public GitHub repositories for unauthorized activity.

IOCs

#	npm package
1	@7nohe/openapi-react-query-codegen@0.0.0-365d4eb738d3146583431948d3ba6e27a32556be
2	@7nohe/openapi-react-query-codegen@0.0.0-ec7876d6c917dad516ba69bbfafc948b834bf0ab
3	@7nohe/openapi-react-query-codegen@0.5.4
4	@7nohe/openapi-react-query-codegen@0.5.5
5	@7nohe/openapi-react-query-codegen@1.6.3
6	@7nohe/openapi-react-query-codegen@1.6.4
7	@7nohe/openapi-react-query-codegen@2.2.1
8	@7nohe/openapi-react-query-codegen@2.2.2
9	@7nohe/openapi-react-query-codegen@3.0.3
10	@7nohe/openapi-react-query-codegen@3.0.4

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

★ Which Security Tools Should You Cut? Score Them on One Page – Download the Inherited Security Stack Guide