@7nohe/openapi-react-query-codegen: ten published versions after an abused GitHub Actions publishing workflow
Socket (28 August 2026) reports that ten versions of npm package @7nohe/openapi-react-query-codegen were published that day after a comment-triggered GitHub Actions trusted-publishing workflow was abused. An untrusted GitHub account could comment a publish trigger on a pull request and ship fork code under the repository OIDC identity. Versions named by Socket and Step Security are 0.5.4, 0.5.5, 1.6.3, 1.6.4, 2.2.1, 2.2.2, 3.0.3, 3.0.4, plus two 0.0.0-sha prerelease tags. Stable releases ran obfuscated JavaScript 3FWCvzduYZg.js via binding.gyp and/or a preinstall hook. Socket describes Mini Shai-Hulud-consistent self-propagation. Install-time code targeted cloud credentials, package-registry credentials, GitHub Actions secrets and AI-agent configuration. All ten carried valid npm provenance. Pin known-good 0.5.3, 1.6.2, 2.2.0 or 3.0.2, isolate affected hosts, then rotate tokens. This desk does not attribute the package to TeamPCP; Socket and Step Security do not name that group.
- Product
- @7nohe/openapi-react-query-codegen
- Versions
- Affected: 0.5.4, 0.5.5, 1.6.3, 1.6.4, 2.2.1, 2.2.2, 3.0.3, 3.0.4 plus two 0.0.0-sha tags; known-good 0.5.3 / 1.6.2 / 2.2.0 / 3.0.2
- Exploited in Australia?
- unknown
- Patch to
- Uninstall affected versions, pin known-good, isolate, then rotate tokens
Primary: Socket (28 Aug 2026) ยท Step Security (28 Aug 2026)