Socket researchers found that @7nohe/openapi-react-query-codegen was compromised with ten malicious npm versions published through an abused comment-triggered GitHub Actions workflow, and the latest tag still resolved to a poisoned release at the time of reporting. The payload installs a large obfuscated loader that steals cloud, registry, GitHub Actions, and AI-related secrets while showing self-propagation behavior consistent with Mini Shai-Hulud. #MiniShaiHulud #openapi-react-query-codegen #GitHubActions #npm #SocketThreatResearchTeam
Keypoints
- The npm package @7nohe/openapi-react-query-codegen was compromised with ten malicious versions published on August 28, 2026.
- The malicious releases remained installable, and the latest tag resolved to version 3.0.4 at the time of writing.
- The package’s install path executed a bundled JavaScript loader that decrypted and ran a second-stage payload.
- The payload targeted cloud credentials, package registry credentials, GitHub Actions secrets, and AI agent configuration.
- All malicious versions carried valid npm provenance attestations, showing that provenance did not prevent the compromise.
- The attacker abused a comment-triggered GitHub Actions publishing workflow that could be invoked by an untrusted GitHub account.
- The broader activity was consistent with Mini Shai-Hulud-style self-propagation and supply-chain abuse.
MITRE Techniques
- [T1195.002 ] Compromise Software Supply Chain – Malicious npm versions were published through a trusted publishing workflow, poisoning a package release stream (‘ten malicious versions were published… with valid npm provenance’).
- [T1059.006 ] Command and Scripting Interpreter: Python – A malicious binding.gyp used an obfuscated Python expression to reach os.system and launch the loader (‘uses an obfuscated Python expression to reach os.system’).
- [T1204.002 ] User Execution: Malicious File – The install-time payload executed when users ran npm install or node-gyp processing (‘This fires on npm install in developer environments and CI runners’).
- [T1027 ] Obfuscated Files or Information – The root payload was XOR-obfuscated and the command strings were Unicode-escaped (‘a ~5.7 MB single-byte-XOR-obfuscated file’).
- [T1053.005 ] Scheduled Task/Job: Launch Agent – On macOS, the implant created a LaunchAgent for persistence (‘it creates and bootstraps a LaunchAgent with RunAtLoad and KeepAlive’).
- [T1053.006 ] Scheduled Task/Job: Systemd Service – On Linux, the implant created and enabled a user systemd service (‘it creates and enables a user systemd service’).
- [T1555 ] Credentials from Password Stores – The payload searched files, configs, and process memory for tokens and secrets (‘scan files, process memory, cloud metadata, and CI variables’).
- [T1005 ] Data from Local System – It recursively scanned the working tree and dotfiles for secrets (‘recursively scans the current working tree, including dotfiles’).
- [T1057 ] Process Discovery – It enumerated candidate processes and dumped their memory to recover secrets (‘launches this helper against candidate processes’).
- [T1560.001 ] Archive Collected Data: Archive via Utility – Collected data was compressed with gzip before encryption (‘serializes the collected JSON, compresses it with gzip’).
- [T1022 ] Data Encrypted – Exfiltration was encrypted with AES-256-GCM and RSA-OAEP wrapping (‘encrypts the compressed data with AES-256-GCM’).
- [T1190 ] Exploit Public-Facing Application – The workflow abuse allowed any GitHub account to publish code via comment text (‘Any GitHub account can publish a fork’s contents under this repository’s OIDC identity’).
- [T1105 ] Ingress Tool Transfer – The payload downloaded Bun from GitHub to continue execution (‘downloads a Bun 1.4.0 asset for Linux or macOS’).
- [T1106 ] Native API – The code used os.system, child_process.execSync, execFileSync, and related APIs to run payloads (‘invoke os.system()’ and ‘executes it via child_process.execSync’).
- [T1546.016 ] Event Triggered Execution: Installer Packages – Package install/build events triggered malicious code during dependency handling (‘binding.gyp is processed by node-gyp during installation’).
Indicators of Compromise
- [Package names and versions ] compromised npm releases – @7nohe/openapi-react-query-codegen@0.0.0-365d4eb738d3146583431948d3ba6e27a32556be, @7nohe/[email protected], and 8 more malicious versions
- [File names ] malicious loader and persistence files – 3FWCvzduYZg.js, binding.gyp, ai_init.js, and ai_setup.sh
- [File paths ] persistence and staging locations – ~/.config/systemd/user/sysvinit-detect-fash.service, ~/Library/LaunchAgents/com.user.sysvinit-detect-fash.plist, and /var/tmp/.shit
- [Repository and GitHub infrastructure ] attacker staging and abuse – github[.]com/p00paboot/openapi-react-query-codegen, github[.]com/p00paboot, and the malicious commit 365d4eb738d3146583431948d3ba6e27a32556be
- [Environment variables ] execution context and targeting – WORKFLOW_ID=release.yml, REPO_ID_SUFFIX=7nohe/openapi-react-query-codegen, and TARGET_PACKAGES=@7nohe/openapi-react-query-codegen
- [Hashes ] package artifact hashes – b49afb7dba04cd99b357ce7c652c823a3707f28e130bd5c6645851a7adc030d6, 59370c67b54a0ccaedd265e2356f04540b2fba1e1845300ef6de4d5437d99380, and other 1 hash
- [URLs ] legitimate infrastructure abused by the malware – https://api.github.com/user, https://registry.npmjs.org/-/npm/v1/tokens, and https://upload.pypi.org/legacy/
Read more: https://socket.dev/blog/openapi-react-query-codegen-npm-compromise