openapi-react-query-codegen Compromised: Rotate Your CI Credentials Now

Mini Shai-Hulud is back. On August 28, the supply chain worm that has been methodically tearing through npm since March hit @7nohe/openapi-react-query-codegen — the popular TanStack Query code generator that generates typed React hooks from OpenAPI specs. Ten malicious versions landed on the npm registry in 20 minutes. If you run this package in CI and any of those versions touched your build, your cloud credentials should be considered compromised.

What Happened

@7nohe/openapi-react-query-codegen gets 671,000 downloads a month. React developers use it to turn OpenAPI schemas into TanStack Query hooks — the kind of package that sits in your devDependencies, runs at code-generation time, and has broad access to whatever environment it executes in.

The attacker did not steal npm credentials. They did not phish the maintainer. Instead, they exploited a misconfigured GitHub Actions workflow. The repository’s release pipeline used an issue_comment trigger without restricting which GitHub users could activate it. There was no author-association gate. Any account could open a forked pull request, comment npm publish, and kick off the pipeline.

The pipeline checked out the fork’s code, ran pnpm install (which executed the attacker’s preinstall hook), and held id-token: write permission — enough to mint a valid npm OIDC publishing token. From there, ten malicious versions published in under 20 minutes. At time of disclosure, npm’s latest tag still resolved to the malicious 3.0.4.

What the Payload Steals

The payload follows Shai-Hulud’s established pattern: download Bun as an obfuscation layer, then sweep the environment for credentials. The sweep is deliberately broad:

• AWS IAM keys and the EC2 metadata endpoint
• GCP service account credentials and the metadata server
• Azure managed identity tokens
• HashiCorp Vault tokens
• Kubernetes service account JWTs
• GitHub PATs and OAuth tokens
• npm, RubyGems, and PyPI publishing tokens
• CI/CD pipeline environment variables (GitHub Actions secrets, CircleCI env vars)

Everything gets encrypted and exfiltrated. If the payload finds usable publish tokens, it replicates — injecting the same malicious hook into other packages owned by the compromised maintainer. Endor Labs confirmed the worm extended its reach to RubyGems and PyPI through stolen registry tokens in this wave.

Are You Affected?

Check whether any compromised versions appear in your dependency tree:

npm list @7nohe/openapi-react-query-codegen
# or search your lockfile directly
grep "@7nohe/openapi-react-query-codegen" package-lock.json

The malicious versions are: 0.5.4, 0.5.5, 1.6.3, 1.6.4, 2.2.1, 2.2.2, 3.0.3, and 3.0.4. If any of these ran in a CI environment with cloud access, treat all credentials in that environment as stolen.

What to Do Right Now

Rotate before you continue reading. The payload targets everything it finds, so partial rotation is not enough. Rotate: AWS IAM keys, GCP service account keys, Azure managed identity tokens, GitHub PATs, npm publish tokens, PyPI API tokens, RubyGems API keys, HashiCorp Vault tokens, Kubernetes service account tokens, and any CI/CD pipeline secrets. All of them.

After rotation, pin the package to a known-clean version in your package.json — remove the caret or tilde and use an explicit version from before August 28. Watch the project’s GitHub releases for a clean advisory-tagged version before upgrading.

Harden Your Own Workflows

The vulnerability — an ungated issue_comment trigger — is not unique to this repository. It’s common. If your own GitHub Actions workflows use issue_comment, issues, or pull_request_target triggers, audit them now. Add an author-association check:

- name: Check author association
  if: github.event.comment.author_association != 'MEMBER' && 
      github.event.comment.author_association != 'OWNER'
  run: exit 1

The June 2026 release of actions/checkout@v7 blocks common pwn-request patterns by default. If you haven’t pinned to v7, do it now.

Wave 7 of an Ongoing Campaign

This is not an isolated incident. Mini Shai-Hulud has been running since March 2026: axios in March, SAP packages in April, TanStack in May, AntV’s 300-package wave in May, keyv in early August, ChainDrop in mid-August, and now this. Sonatype estimates over 2,200 npm packages compromised and 78,330 secrets stolen from 2,186 organizations across prior waves. That number does not include August 28.

The worm keeps finding targets because misconfigured GitHub Actions workflows are everywhere. npm audit will not catch a freshly published malicious version — it only knows about reported CVEs. The reliable defenses are: audit your own workflows for the same trigger patterns, and install a tool like Socket or Snyk that performs behavioral analysis at install time rather than just CVE lookups.

CVE-2026-45321 has been assigned. Full technical breakdowns are available from SafeDep and StepSecurity. Watch both for clean version announcements.