Mini Shai-Hulud worm hits openapi-react-query-codegen, spreads across npm, RubyGems, and PyPI

On August 28, 2026, multiple releases of the npm package @7nohe/openapi-react-query-codegen, a tool that generates TypeScript API clients and React Query hooks from OpenAPI specifications, were found to contain a Shai-Hulud-style credential-stealing and self-propagating malware payload. The compromise exploited a GitHub Actions release workflow that treated an exact “npm publish” comment on a pull request as authorization to check out and publish the pull request’s code, allowing malicious install hooks and a binding.gyp file to execute an obfuscated payload through multiple paths. Static analysis found that the malware downloaded Bun, harvested credentials from developer systems and CI environments including cloud providers, Vault, Kubernetes, package registries, and GitHub Actions runner memory, then exfiltrated data through repositories created under victims’ GitHub accounts. It also sought to persist through poisoned developer-tool configuration files and to spread using stolen npm, RubyGems, and PyPI tokens, making PyPI a new propagation target for this malware family. Although affected releases carried valid GitHub Actions OIDC and Sigstore provenance attestations, the incident demonstrates that provenance verifies a publishing path rather than the safety of published contents. Users who installed affected versions are advised to treat hosts as compromised, rotate accessible credentials, investigate unauthorized package publications and repository changes, and use known-good integrity-pinned releases while limiting install scripts and automatic native builds.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.