Supply-Chain Attack Compromises Popular npm Package, Exposing Thousands of Development Environments
A sophisticated supply-chain attack targeted @7nohe/openapi-react-query-codegen, an npm package used to generate type-safe TanStack Query hooks, with over 150,000 weekly downloads. Security firm Aikido Security identified 10 malicious versions published within a 20-minute window, exposing developer workstations and CI/CD systems to credential theft, repository backdoors, and secondary package poisoning.
The attack, dubbed "Trinitite: Sponsored by Preview 2 Effects", bears similarities to TeamPCP-linked activity, though attribution remains unconfirmed. Threat actors exploited a GitHub Actions workflow vulnerability, allowing malicious releases to retain provenance attestations a security measure that verifies an artifact’s origin but does not guarantee the workflow itself was uncompromised.
The malware leveraged binding.gyp, a Node.js native-addon build file, to execute an obfuscated payload during installation. Some versions used preinstall scripts, while others combined both techniques. The payload, 3FWCvzduYZg.js, is a 5.4 MB single-line file protected by XOR, AES-GCM, and JavaScript obfuscation, making analysis difficult.
Upon execution, the malware:
- Downloads the Bun runtime to evade detection.
- Checks for analysis environments (Russian locale, scanner decoys, StepSecurity’s harden-runner).
- Harvests credentials for GitHub, npm, PyPI, RubyGems, AWS, Azure, Google Cloud, HashiCorp Vault, Kubernetes, SSH, Git, VPN, and Claude AI.
- Validates cloud credentials via metadata services before exfiltration.
- Encrypts stolen data and commits it to GitHub repositories named after Touhou Project characters, blending credential theft with infrastructure.
The worm can propagate further by reusing publishing tokens to inject malicious files into npm, PyPI, and RubyGems, or backdoor repositories via VS Code tasks, Claude Code hooks, fake CodeQL workflows, or developer tool configurations.
Aikido Security provided indicators of compromise (IOCs), including malicious package versions (@7nohe/openapi-react-query-codegen@1.1.1–1.1.10) and the payload hash (SHA-256: 8e5d1af68ca340ae0c6e8132cb00c686ec2d60502c1994d94ce353d1472ad5a3). Organizations are advised to revoke and rotate exposed credentials, inspect repositories for unauthorized changes, and review GitHub Actions workflows for tampering.
Source: https://gbhackers.com/hackers-compromise-tanstack-query-npm-package/
@7nohe TPRM report: https://www.rankiteo.com/company/aikido-security
Aikido Security TPRM report: https://www.rankiteo.com/company/aikido-security
"id": "aik1787999043",
"linkid": "aikido-security",
"type": "Cyber Attack",
"date": "8/2026",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"{'affected_entities': [{'customers_affected': '150,000+ weekly downloads',
'industry': 'Software Development',
'name': '@7nohe/openapi-react-query-codegen',
'type': 'npm package'}],
'attack_vector': 'GitHub Actions workflow vulnerability, malicious npm '
'package versions',
'data_breach': {'data_encryption': 'Yes (AES-GCM, XOR, JavaScript '
'obfuscation)',
'data_exfiltration': 'Yes (encrypted data committed to GitHub '
'repositories)',
'sensitivity_of_data': 'High (cloud credentials, SSH keys, '
'VPN access, AI tool credentials)',
'type_of_data_compromised': ['Credentials',
'Repository backdoors',
'Malicious package injections']},
'description': 'A sophisticated supply-chain attack targeted '
'@7nohe/openapi-react-query-codegen, an npm package used to '
'generate type-safe TanStack Query hooks, with over 150,000 '
'weekly downloads. Security firm Aikido Security identified 10 '
'malicious versions published within a 20-minute window, '
'exposing developer workstations and CI/CD systems to '
'credential theft, repository backdoors, and secondary package '
'poisoning.',
'impact': {'data_compromised': 'Credentials (GitHub, npm, PyPI, RubyGems, '
'AWS, Azure, Google Cloud, HashiCorp Vault, '
'Kubernetes, SSH, Git, VPN, Claude AI), '
'repository backdoors, malicious package '
'injections',
'identity_theft_risk': 'High (exposure of cloud credentials, SSH '
'keys, and other sensitive data)',
'operational_impact': 'Unauthorized access to development '
'environments, potential secondary attacks '
'via compromised credentials',
'systems_affected': 'Developer workstations, CI/CD systems, '
'npm/PyPI/RubyGems repositories'},
'initial_access_broker': {'backdoors_established': 'Malicious npm package '
'versions, repository '
'backdoors (VS Code tasks, '
'Claude Code hooks, fake '
'CodeQL workflows)',
'entry_point': 'GitHub Actions workflow '
'vulnerability',
'high_value_targets': 'Developer workstations, '
'CI/CD systems, package '
'registries (npm, PyPI, '
'RubyGems)'},
'motivation': 'Credential theft, repository backdoors, secondary package '
'poisoning, data exfiltration',
'post_incident_analysis': {'corrective_actions': 'Removal of malicious '
'packages, credential '
'rotation, repository '
'inspections, workflow '
'hardening',
'root_causes': 'Exploitation of GitHub Actions '
'workflow vulnerability, malicious '
'package publishing with provenance '
'attestations'},
'recommendations': ['Revoke and rotate exposed credentials',
'Inspect repositories for unauthorized changes',
'Review GitHub Actions workflows for tampering',
'Monitor for indicators of compromise (IOCs) provided by '
'Aikido Security'],
'references': [{'source': 'Aikido Security'}],
'response': {'containment_measures': 'Revocation and rotation of exposed '
'credentials, inspection of repositories '
'for unauthorized changes',
'remediation_measures': 'Removal of malicious package versions, '
'review of GitHub Actions workflows for '
'tampering',
'third_party_assistance': 'Aikido Security'},
'threat_actor': 'TeamPCP-linked activity (unconfirmed attribution)',
'title': 'Supply-Chain Attack Compromises Popular npm Package, Exposing '
'Thousands of Development Environments',
'type': 'Supply-Chain Attack',
'vulnerability_exploited': 'GitHub Actions workflow vulnerability allowing '
'malicious releases with provenance attestations'}