Malicious code in devplatform-react-query-s3-client (npm)

Source: amazon-inspector 6ce24f963296b5927f97e05940818b82e397479562fadd357e01c9137f449316 On require/import of devplatform-react-query-s3-client, index.js loads vendor.js which selects a platform-specific payload path linuxx64, linuxarm64, darwin, win32, fetches a binary from one of four Cloudfla...

Malicious code in devplatform-react-query-clients (npm)

Source: amazon-inspector 192681d10673d935bcba617102ed5581cc928ba8ebedda203cebe5d33d7f067a On require of the package, index.js loads adapter.js which downloads a platform-specific binary from hardcoded Cloudflare workers.dev endpoints oob-worker.cf99-9b3.workers.dev,...

EUVD-2026-62599

Orval: RCE via OpenAPI path - unescaped request-URL template literal backtick breakout...

MSC-2026-11522

Active npm supply chain compromise of @7nohe/openapi-react-query-codegen 150,000 weekly downloads, linked to the ongoing Mini Shai-Hulud campaign. An unprotected GitHub Actions release workflow let any account publish fork contents under the repository's trusted-publishing identity, producing ten...

Malware in @7nohe/openapi-react-query-codegen

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2026-15494 Malicious code in @7nohe/openapi-react-query-codegen (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ab8f8efdad9084d2a7c5ae5058ffc18886d68bfe1c676239fd7e0d41342fc700 The tarball ships a binding.gyp at the package root whose conditions field abuses GYP's Python expression evaluator to walk .class.base.subclasses to...

Malicious code in @7nohe/openapi-react-query-codegen (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ab8f8efdad9084d2a7c5ae5058ffc18886d68bfe1c676239fd7e0d41342fc700 The tarball ships a binding.gyp at the package root whose conditions field abuses GYP's Python expression evaluator to walk .class.base.subclasses to...

Embedded Malicious Code

Overview @7nohe/openapi-react-query-codegen is an OpenAPI React Query Codegen Affected versions of this package are vulnerable to Embedded Malicious Code that conceals a destructive worm and credential harvester. A malicious actor exploited a comment-triggered GitHub Actions workflow by commentin...

CVE-2026-62681 Orval: RCE via OpenAPI path -> unescaped request-URL template literal (backtick breakout)

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, an unescaped backtick in an OpenAPI path is emitted into request URL template literals generated for axios, fetch, react-query, and SWR clients without safe encoding. This...

CVE-2026-62681

In Orval

CVE-2026-62681 Orval: RCE via OpenAPI path -> unescaped request-URL template literal (backtick breakout)

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, an unescaped backtick in an OpenAPI path is emitted into request URL template literals generated for axios, fetch, react-query, and SWR clients without safe encoding. This...

Malware in hubert-react-query

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in devplatform-react-query-clients (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 192681d10673d935bcba617102ed5581cc928ba8ebedda203cebe5d33d7f067a On require of the package, index.js loads adapter.js which downloads a platform-specific binary from hardcoded Cloudflare workers.dev endpoints...

Malicious code in hubert-react-query (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 765788871d6200a403058846fe3599c2c59588a6b00efc9ee770d7d1501e1b74 The package's main entry index.js unconditionally requires./setup.js on import. setup.js reconstructs Cloudflare Workers hostnames from string-fragme...

MAL-2026-12181 Malicious code in hubert-react-query (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 765788871d6200a403058846fe3599c2c59588a6b00efc9ee770d7d1501e1b74 The package's main entry index.js unconditionally requires./setup.js on import. setup.js reconstructs Cloudflare Workers hostnames from string-fragme...

Malicious Package

Overview hubert-react-query is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Exploit for CVE-2026-26903

CVE-2026-26903 PoC Denial-of-service via unbounded recursio...

Malicious code in react-query-core-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3bce94f40a0e1879b184cd9f5abb5f4850d66aa5705b231b41337c2e2e33a3de The package react-query-core-utils was found to contain malicious code...

MAL-2026-1837 Malicious code in react-query-core-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3bce94f40a0e1879b184cd9f5abb5f4850d66aa5705b231b41337c2e2e33a3de The package react-query-core-utils was found to contain malicious code...

Malware in typescript-react-query

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...