Shai-Hulud Trinitite Worm Infects Popular TanStack Query npm Package to Steal Developer Secrets

A new Shai-Hulud supply-chain attack dubbed Trinitite has compromised the npm package @7nohe/openapi-react-query-codegen, a TanStack Query code-generation library with more than 150,000 weekly downloads.

The malicious releases deploy an evolved Mini Shai-Hulud worm designed to steal developer, cloud, CI/CD, package-registry, Kubernetes, Vault, and source-control credentials before using recovered access to spread through additional packages.

While the samples share tooling, propagation behavior, and operational patterns with earlier “Here We Go Again,” May 19 @antv, and Miasma waves, the available payload does not conclusively establish attribution.

The notable changes are the release-chain abuse, fresh RSA keys, new campaign strings, and a concealed binding.gyp execution path.research.

The compromise began with a dangerous GitHub Actions release workflow configuration. The project treated a pull request comment containing the exact phrase “npm publish” as authorization to publish a release.

The workflow then checked out the pull request and used GitHub Actions OIDC with id-token: write to publish it, without verifying that the commenter was a repository maintainer.

A GitHub account named p00paboot reportedly opened the malicious pull requests and issued the release trigger. This allowed the workflow to mint a legitimate trusted-publishing token and generate artifacts with valid provenance.

The incident again demonstrates that provenance confirms where an artifact was built, but not whether attacker-controlled code executed inside the trusted release environment.research.

The attackers initially published two prereleases. The first, 0.0.0-365d4eb…, contained a suspicious preinstall command that installed Bun and attempted to launch a missing file named is_it_this_simple.js.

It did not include the final payload, but its environment variables already identified the intended workflow and target package.

The following eight stable releases carried the actual worm: 0.5.4, 0.5.5, 1.6.3, 1.6.4, 2.2.1, 2.2.2, 3.0.3, and 3.0.4.

The most important technical change is the use of a malicious binding.gyp file.

The first wave of stable versions relied exclusively on this file, while releases published about 20 minutes later added a conventional preinstall script calling node 3FWCvzduYZg.js.

JFrog Security Research said the campaign, was detected on August 28, 2026, shortly after the reported late-August arrests in Australia of individuals associated with TeamPCP.

The file 3FWCvzduYZg.js is a 4 MB to 6 MB XOR-obfuscated loader. Although npm install –ignore-scripts can suppress the visible preinstall hook, the threat can still execute when node-gyp evaluates the planted binding.gyp file.

Shai-Hulud Trinitite Worm

Attackers hid the command inside Unicode-escaped Python code placed in a conditions statement. Once decoded, the expression reaches Python built-ins and runs os.system(‘node 3FWCvzduYZg.js’).

Because node-gyp processes conditions through Python, security tools that inspect only package.json lifecycle scripts may miss the malicious execution chain.

The loader decodes an integer array using XOR key 9, decrypts two AES-128-GCM blobs, downloads Bun v1.4.0 if needed, and runs the decrypted worm from a temporary JavaScript file.

The payload then deletes the temporary stage. Its internal modules use further obfuscation, PBKDF2-SHA256 with 200,000 rounds, AES-256-GCM encryption, and gzip-compressed embedded components.

Once active, Trinitite targets GitHub, npm, PyPI, RubyGems, cloud credentials, Vault tokens, Kubernetes material, SSH keys, Docker credentials, and CI/CD secrets.

It can scrape Runner.Worker memory for values marked “isSecret”:true, including identity material that may never be saved to disk.

Stolen data is compressed, encrypted, RSA-wrapped, and committed to attacker-controlled public GitHub repositories created through victim tokens.research.

The worm also includes logic to republish packages for which it obtains npm publishing rights.

In GitHub Actions environments, it can exchange stolen OIDC material for npm publishing credentials, creating the feedback loop that makes Shai-Hulud a propagating package worm rather than a standalone credential stealer.research.

Trinitite retains Shai-Hulud’s destructive token-revocation trap. On Linux and macOS, it can install persistence under names including systemd-detect-fash and sysvinit-detect-fash, alongside a Python monitor at ~/.local/share/diaper/poopy.py.

If a monitored GitHub token becomes invalid, the stored handler may attempt to wipe the user’s home directory and ~/Documents.

Organizations that installed an affected version should isolate the developer workstation or CI runner first, terminate and remove persistence, and only then revoke credentials.

Defenders should inspect installations and build artifacts for 3FWCvzduYZg.js, binding.gyp, Frot, dog.c, trinnyyyy-*, /var/tmp/.shit, and the renamed “ClaudeCode Review” GitHub Actions workflow.

Teams should pin the package to known-safe releases 0.5.3, 1.6.2, 2.2.0, or 3.0.2, regenerate lockfiles from trusted sources, rebuild potentially exposed runners, and rotate GitHub, npm, PyPI, RubyGems, cloud, SSH, Kubernetes, Vault, and CI/CD credentials from a clean environment.

IOCs

Package	Xray ID	Versions
@7nohe/openapi-react-query-codegen	XRAY-1065308	0.5.4, 0.5.5, 1.6.3, 1.6.4, 2.2.1, 2.2.2, 3.0.3, 3.0.4, 0.0.0-365d4eb738d3146583431948d3ba6e27a32556be, 0.0.0-ec7876d6c917dad516ba69bbfafc948b834bf0ab

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

★ Which Security Tools Should You Cut? Score Them on One Page – Download the Inherited Security Stack Guide