EUVD-2026-62599

Orval: RCE via OpenAPI path - unescaped request-URL template literal backtick breakout...

MSC-2026-11522

Active npm supply chain compromise of @7nohe/openapi-react-query-codegen 150,000 weekly downloads, linked to the ongoing Mini Shai-Hulud campaign. An unprotected GitHub Actions release workflow let any account publish fork contents under the repository's trusted-publishing identity, producing ten...

Malicious code in @7nohe/openapi-react-query-codegen (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ab8f8efdad9084d2a7c5ae5058ffc18886d68bfe1c676239fd7e0d41342fc700 The tarball ships a binding.gyp at the package root whose conditions field abuses GYP's Python expression evaluator to walk .class.base.subclasses to...

MAL-2026-15494 Malicious code in @7nohe/openapi-react-query-codegen (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ab8f8efdad9084d2a7c5ae5058ffc18886d68bfe1c676239fd7e0d41342fc700 The tarball ships a binding.gyp at the package root whose conditions field abuses GYP's Python expression evaluator to walk .class.base.subclasses to...

Embedded Malicious Code

Overview @7nohe/openapi-react-query-codegen is an OpenAPI React Query Codegen Affected versions of this package are vulnerable to Embedded Malicious Code that conceals a destructive worm and credential harvester. A malicious actor exploited a comment-triggered GitHub Actions workflow by commentin...

CVE-2026-62681

In Orval

CVE-2026-62681 Orval: RCE via OpenAPI path -> unescaped request-URL template literal (backtick breakout)

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, an unescaped backtick in an OpenAPI path is emitted into request URL template literals generated for axios, fetch, react-query, and SWR clients without safe encoding. This...

CVE-2026-62681 Orval: RCE via OpenAPI path -> unescaped request-URL template literal (backtick breakout)

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, an unescaped backtick in an OpenAPI path is emitted into request URL template literals generated for axios, fetch, react-query, and SWR clients without safe encoding. This...

Malicious code in devplatform-react-query-clients (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 192681d10673d935bcba617102ed5581cc928ba8ebedda203cebe5d33d7f067a On require of the package, index.js loads adapter.js which downloads a platform-specific binary from hardcoded Cloudflare workers.dev endpoints...

Malicious code in hubert-react-query (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 765788871d6200a403058846fe3599c2c59588a6b00efc9ee770d7d1501e1b74 The package's main entry index.js unconditionally requires./setup.js on import. setup.js reconstructs Cloudflare Workers hostnames from string-fragme...

MAL-2026-12181 Malicious code in hubert-react-query (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 765788871d6200a403058846fe3599c2c59588a6b00efc9ee770d7d1501e1b74 The package's main entry index.js unconditionally requires./setup.js on import. setup.js reconstructs Cloudflare Workers hostnames from string-fragme...

Malicious Package

Overview hubert-react-query is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Exploit for CVE-2026-26903

CVE-2026-26903 PoC Denial-of-service via unbounded recursio...

Malicious code in react-query-core-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3bce94f40a0e1879b184cd9f5abb5f4850d66aa5705b231b41337c2e2e33a3de The package react-query-core-utils was found to contain malicious code...

MAL-2026-1837 Malicious code in react-query-core-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3bce94f40a0e1879b184cd9f5abb5f4850d66aa5705b231b41337c2e2e33a3de The package react-query-core-utils was found to contain malicious code...

MAL-2026-1553 Malicious code in typescript-react-query (npm)

The package 'typescript-react-query' is part of the PhantomRaven supply chain attack campaign Wave 2. It uses a Remote Dynamic Dependency RDD technique: the published package appears benign but includes a URL-based dependency in package.json pointing to an attacker-controlled C2 server...

Malicious code in @sev-ui-verse/react-query-client (npm)

The package @sev-ui-verse/react-query-client was found to contain malicious code. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 665474d528ec1e43349cea649e53f67e00e56ef1f98b376e17c5a672fa0a7270 Any computer that has this package installed or running should be...

MAL-2025-47544 Malicious code in @sev-ui-verse/react-query-client (npm)

The package @sev-ui-verse/react-query-client was found to contain malicious code. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 665474d528ec1e43349cea649e53f67e00e56ef1f98b376e17c5a672fa0a7270 Any computer that has this package installed or running should be...

Malware in @sev-ui-verse/react-query-utils

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2025-47545 Malicious code in @sev-ui-verse/react-query-utils (npm)

The package @sev-ui-verse/react-query-utils was found to contain malicious code. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b7159ac6527ad39a63e64403ef1ba63e8895558c89c17cf8355a6bfee386a761 Any computer that has this package installed or running should be...