@7nohe/openapi-react-query-codegen Compromised Through an Exposed npm Publishing Workflow

On August 28, 2026, the npm package @7nohe/openapi-react-query-codegen was compromised via an exposed GitHub Actions workflow that allowed unauthorized publishing. An external attacker exploited a permissive release workflow triggered by a comment from any pull request participant, leading to the publication of ten malicious versions. These versions included obfuscated payloads and malicious preinstall hooks that executed during installation, downloading and running the Bun executable, probing for GitHub credentials, and exfiltrating sensitive data. The attack leveraged npm Trusted Publishing with GitHub Actions OIDC, allowing code execution without needing the maintainer's npm token.

AI-extracted · verify before operational use