Loading story…
Ten malicious versions of @7nohe/openapi-react-query-codegen, a TanStack Query code generator with more than 150,000 weekly downloads, were published after an external GitHub user exploited its release workflow. The workflow accepted an exact npm-publish comment from any pull-request participant, checked out untrusted pull-request code, and used the repository's GitHub Actions OIDC trusted-publishing identity to release it; consequently, the malicious packages carried valid npm provenance attestations. At the time of reporting, npm's latest tag reportedly referenced malicious version 3.0.4.
The releases execute code during installation through preinstall hooks, malicious binding.gyp logic evaluated by node-gyp, or both, then launch an obfuscated second-stage payload. The malware downloads and executes Bun, probes Google Cloud metadata services, harvests credentials from cloud, GitHub, package registries, containers, Kubernetes, Vault, cryptocurrency wallets, messaging, VPN, and AI-development tools, and can propagate through accessible development environments; stolen data is exfiltrated through GitHub repositories labeled “Trinitite: Sponsored by Preview 2 Effects.” Organizations that installed affected versions with lifecycle scripts enabled should isolate and rebuild impacted systems, remove persistence and cached artifacts, and rotate all potentially exposed credentials from a clean environment using reviewed lockfiles and known-good releases.
Trace attribution and downstream blast radius.
4 events from the most recent confirmed update back to the earliest known activity.
A commit containing the “Trinitite: Sponsored by Preview 2 Effects” marker was identified in a GitHub repository used by the Shai-Hulud variant. Researchers identified nine public repositories containing stolen credentials and documented new exfiltration, execution, and obfuscation indicators for the variant.
Researchers identified the malicious @7nohe/openapi-react-query-codegen releases, including versions 0.5.4 through 3.0.4 and two prereleases. Analysis found an obfuscated payload that harvested cloud, source-control, package-registry, container, Kubernetes, Vault, cryptocurrency, VPN, messaging, and AI-development credentials, with self-propagation functionality.
An external GitHub user abused the package's issue-comment-triggered release workflow, which checked out untrusted pull-request code and used GitHub Actions OIDC trusted publishing, to publish ten malicious @7nohe/openapi-react-query-codegen versions. The stable releases were published in two waves between 20:00:43 and 20:20:53 UTC and included install-time execution mechanisms targeting developer workstations and CI runners.
Researchers reported additional technical details of the malicious payload, including encrypted exfiltration via attacker-created public GitHub repositories, macOS LaunchAgent and Linux systemd-user persistence, signed GitHub commits used as a command channel, and SSH-based propagation attempts. The report also noted that valid npm provenance attestations were present on the malicious releases, while cautioning that behavioral overlap with Mini Shai-Hulud does not establish common-operator attribution.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 21 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
5 references tracked. Mallory keeps watching after this page renders.
thecybersecguru.com
Open sourceox.security
Open sourcestepsecurity.io
Open sourceaikido.dev
Open sourcesocket.dev
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A software supply chain compromise hit the JavaScript ecosystem after malicious versions of **Keyv** and related npm packages were published through legitimate maintainer workflows, with `keyv@6.0.0` identified as a primary malicious release. Researchers said the tainted packages added a `preinstall` hook that executed attacker code during dependency installation on developer workstations and CI runners, while some repositories also contained malicious **VS Code** and **Claude Code** configuration files that could trigger execution when a cloned project was opened. Early community reports tied the incident to the `jaredwray/cacheable` package set and warned that numerous downstream dependencies were exposed. Analysis found the malware targeted high-value secrets including **GitHub** and **npm** tokens, cloud credentials, Vault tokens, Kubernetes service account tokens, SSH keys, and TLS certificates, with tradecraft resembling the **Shai-Hulud** malware family. Investigators reported no evidence that npm itself was breached; instead, the attackers appear to have used stolen maintainer credentials and trusted GitHub Actions publishing pipelines with valid provenance and npm attestation, demonstrating that provenance verified the build source but not whether the source had already been maliciously altered. Responders were urged to avoid affected versions, isolate any host that installed them, remove persistence such as `gh-token-monitor`, and rotate exposed credentials from a clean system.
Aug 8, 2026
A supply-chain compromise in the `react-tracked` GitHub repository led to attacker-controlled code execution during `npm install` after malicious commits briefly landed on the default branch. The implant added `src/install.js` and a `postinstall` hook that fetched and evaluated a remote JavaScript payload from an attacker-controlled HTTPS endpoint, disabled TLS verification, and avoided CI and cloud or serverless environments to focus on developer workstations. Although the tainted code was never published to npm and was later force-pushed away, any developer who installed from an affected checkout, fork, local clone, or direct commit reference may have been exposed; impacted systems should be treated as fully compromised and reachable credentials rotated. The incident fits a broader wave of developer-focused software supply-chain attacks that has intensified across GitHub, npm, PyPI, Docker Hub, and CI/CD environments. Recent reporting tied the March 2026 compromises of tools including Trivy, Checkmarx KICS, and LiteLLM to TeamPCP, a threat cluster Oligo Security says overlaps with the longer-running TA-NATALSTATUS and ShadowRay 2.0 activity through shared infrastructure, staging paths, and deployment scripts. Researchers say these campaigns increasingly abuse trusted developer platforms, steal tokens, and use malicious repositories, workflows, and packages to reach workstations and cloud-connected build environments.
Aug 12, 2026
Security researchers reported multiple **software supply chain** campaigns targeting developers through malicious packages in public repositories, aiming to steal credentials/secrets and establish persistent access that can later impact production environments. Socket disclosed a campaign dubbed **StegaBin** involving **26 malicious npm packages** published over a two-day window that used a Pastebin “dead-drop” with **character-level steganography** to conceal C2 details, then resolved additional infrastructure across **31 Vercel deployments** to deliver platform-specific shell payloads that install a RAT and a **nine-module infostealer** targeting VSCode data, SSH keys, git repositories, browser credential stores, clipboard contents, and other local secrets. Socket assessed the tradecraft as consistent with activity previously attributed to **North Korea-aligned FAMOUS CHOLLIMA (Lazarus-linked)** and noted rapid detection of the packages shortly after publication. Separately, reporting highlighted **four malicious NuGet packages**—`NCryptYo`, `DOMOAuth2_`, `IRAOAuth2.0`, and `SimpleWriter_`—that targeted **ASP.NET** developers by exfiltrating **ASP.NET Identity** data (users/roles/permissions) and enabling backdoors; the packages were published in August 2024, accumulated **4,500+ downloads**, and were later removed. In that campaign, `NCryptYo` functioned as a dropper and proxy to an attacker-controlled C2, while `DOMOAuth2_` and `IRAOAuth2.0` handled data theft and backdoor rule delivery, and `SimpleWriter_` enabled file writing and hidden process execution while masquerading as a PDF utility. Other items in the set described unrelated C2 tooling trends (a Polygon blockchain-based botnet loader and the Vshell C2 framework) and do not describe the same package-repository supply chain incidents.
Jun 29, 2026