@7nohe/openapi-react-query-codegen Compromised Through an Exposed npm Publishing Workflow

What it is

A supply-chain compromise of the npm package @7nohe/openapi-react-query-codegen, exploited on August 28, 2026 by GitHub user p00paboot. Ten malicious versions were published. Critically, at StepSecurity's publication time npm still mapped latest to malicious version 3.0.4 and had not deprecated it — installing @latest pulls the payload.

How it works

The repository's release workflow listened for issue_comment events and required only that the comment belonged to a PR and its body exactly matched npm publish. It did not check the commenter's role. On a match it checked out the PR head, ran pnpm install, and published via npm Trusted Publishing with id-token: write — placing untrusted PR code inside a privileged OIDC job. The attacker opened PRs #215/#216 and posted the trigger comment. Malicious versions carry either the preinstall hook "preinstall": "node 3FWCvzduYZg.js", a poisoned binding.gyp that decodes to node 3FWCvzduYZg.js via os.system(), or both. The payload downloads Bun to /tmp/trinnyyyy-*/bun, then runs gh auth token and git credential-manager github list --no-ui, probes for SSH/scp and Google Cloud metadata, and enumerates processes.

Affected versions (IOCs)

0.5.4  0.5.5  1.6.3  1.6.4  2.2.1  2.2.2  3.0.3  3.0.4
0.0.0-365d4eb738d3146583431948d3ba6e27a32556be
0.0.0-ec7876d6c917dad516ba69bbfafc948b834bf0ab

Payload 3FWCvzduYZg.js (6,384,601 bytes), SHA256:

b24d121667f21f492cb9db34fbfd515d5922a8dd30b9c45215c7220abbb10ca8

Artifacts: 3FWCvzduYZg.js, binding.gyp, is_it_this_simple.js, nu.js, /tmp/trinnyyyy-*/bun, /tmp/*/updater.py. Version 0.5.4 jumped from 41,621 bytes (in 0.5.3) to 5,658,449 bytes — a size-inflation signal.

What to do

• Do not install @7nohe/openapi-react-query-codegen@latest.
• Search workflow logs, dependency caches, lockfiles, SBOMs, and build provenance for the affected versions.
• Search dev workstations for the payload filename, trinnyyyy temp directories, and unexpected Bun executables created at install time.
• If an affected version ran install scripts: stop builds, isolate the system, and from a separate clean machine rotate npm, GitHub, cloud, CI/CD, SSH, signing, and deployment credentials the process could reach. Invalidate active sessions and review audit logs.

Caveats

Only four stable versions (1.6.3, 2.2.1, 3.0.3, 3.0.4) were confirmed "detonated" behaviorally; 0.5.5, 1.6.4, and 2.2.2 were identified via matching registry metadata rather than direct execution. The security-score-0 verdict on 3.0.4 came from StepSecurity's static-analysis model; the runtime findings are the direct behavioral evidence, reproduced on isolated GitHub-hosted runners under Harden-Runner.