OpenAPI React Query Codegen Compromised in Mini Shai-Hulud npm Supply Chain Attack

The npm package @7nohe/openapi-react-query-codegen was compromised in a supply chain attack dubbed 'Mini Shai-Hulud', where ten malicious versions were published using a comment-triggered GitHub Actions workflow vulnerability. The malicious code executes during installation via an obfuscated JavaScript loader (3FWCvzduYZg.js), which decrypts and runs a second-stage payload designed to steal cloud credentials, package registry tokens, GitHub Actions secrets, and AI agent configurations. The payload includes self-propagation capabilities, including SSH-based lateral movement, GitHub Actions workflow tampering, and package poisoning across npm, JFrog, RubyGems, and PyPI. All malicious versions carry valid npm provenance attestations, making them appear legitimate despite containing attacker-controlled code.

AI-extracted · verify before operational use