MSC-2026-11522

Active npm supply chain compromise of @7nohe/openapi-react-query-codegen 150,000 weekly downloads, linked to the ongoing Mini Shai-Hulud campaign. An unprotected GitHub Actions release workflow let any account publish fork contents under the repository's trusted-publishing identity, producing ten...

Malware in @7nohe/openapi-react-query-codegen

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2026-15494 Malicious code in @7nohe/openapi-react-query-codegen (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ab8f8efdad9084d2a7c5ae5058ffc18886d68bfe1c676239fd7e0d41342fc700 The tarball ships a binding.gyp at the package root whose conditions field abuses GYP's Python expression evaluator to walk .class.base.subclasses to...

Malicious code in @7nohe/openapi-react-query-codegen (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ab8f8efdad9084d2a7c5ae5058ffc18886d68bfe1c676239fd7e0d41342fc700 The tarball ships a binding.gyp at the package root whose conditions field abuses GYP's Python expression evaluator to walk .class.base.subclasses to...

Embedded Malicious Code

Overview @7nohe/openapi-react-query-codegen is an OpenAPI React Query Codegen Affected versions of this package are vulnerable to Embedded Malicious Code that conceals a destructive worm and credential harvester. A malicious actor exploited a comment-triggered GitHub Actions workflow by commentin...