JFrog researchers on August 28 flagged a new Mini Shai-Hulud wave — tracked as Trinitite — that compromised @7nohe/openapi-react-query-codegen, a TanStack Query code-generation package pulling roughly 150,000 weekly npm downloads. Ten malicious versions went out in two publishing bursts about twenty minutes apart, and the worm’s credential-harvesting payload is now the fourth or fifth distinct Mini Shai-Hulud variant to hit npm this year. What sets Trinitite apart isn’t the payload — it’s how the attacker got a legitimate publish to fire without ever touching a maintainer’s laptop or npm token.

What happened

Instead of phishing a maintainer or stealing an .npmrc token, the attacker abused the package’s own release automation. The repository’s GitHub Actions workflow could be triggered by a specific comment string left on a pull request, and that workflow ran with GitHub’s OIDC trusted-publishing flow to obtain a short-lived npm publish token. By opening a PR and posting the trigger comment, the attacker got the project’s own CI to check out attacker-influenced state and mint a valid, unrevoked publishing credential on demand — no stolen secret required, because the “secret” is minted fresh from a workflow the attacker learned how to fire.

Affected versions: 0.5.4, 0.5.5, 1.6.3, 1.6.4, 2.2.1, 2.2.2, 3.0.3, and 3.0.4. Clean versions to pin back to are 0.5.3, 1.6.2, 2.2.0, and 3.0.2.

How the payload works

Each malicious release ships a binding.gyp file — normally used to configure native module builds via node-gyp — containing a Unicode-escaped Python condition. Because node-gyp evaluates binding.gyp conditionals during install, that escaped string decodes to os.system('node 3FWCvzduYZg.js') and runs regardless of whether npm install --ignore-scripts is set. Scanners and policies that only inspect package.json lifecycle hooks (preinstall/postinstall) miss this entirely, since the execution path never touches those fields.

3FWCvzduYZg.js is a 4–6MB XOR-obfuscated loader. It decrypts and hands off to a larger Shai-Hulud worm body, executed through the Bun runtime, then deletes itself to reduce forensic footprint. Once running, it enumerates and exfiltrates GitHub tokens, npm and PyPI credentials, RubyGems tokens, cloud provider credentials (AWS/GCP/Azure), HashiCorp Vault tokens, Kubernetes config and service-account material, SSH private keys, Docker registry credentials, and CI/CD platform secrets. Consistent with earlier Shai-Hulud/Mini Shai-Hulud waves, any recovered publish rights are reused immediately to push the same loader into further packages — the self-propagation mechanic that gives the family its name.

Impact

@7nohe/openapi-react-query-codegen sits in the build tooling for any project generating TanStack Query hooks from an OpenAPI spec — meaning exposure runs through CI and build pipelines, not just developer laptops, and those are exactly the environments richest in exactly the credentials this worm hunts for. Because the publish came from a legitimate, OIDC-authenticated CI identity, package managers and provenance checks that only verify “was this built by the project’s own pipeline” would not have flagged anything wrong — the pipeline itself was the attacker’s foothold.

If your dependency tree resolved any of the listed versions between August 28 and whenever your lockfile was last refreshed, treat every credential reachable from that install (developer workstation or CI runner) as compromised.

Mitigation

  • Run npm ls @7nohe/openapi-react-query-codegen across your repos and pin to 0.5.3, 1.6.2, 2.2.0, or 3.0.2, or later confirmed-clean releases.
  • Do not rely on --ignore-scripts alone as a defense — the binding.gyp/node-gyp execution path bypasses it. Use a registry proxy or install firewall that inspects binding.gyp conditionals, not just lifecycle scripts.
  • Rotate GitHub PATs, Actions secrets, npm/PyPI/RubyGems tokens, cloud credentials, Vault tokens, kubeconfigs, SSH keys, and Docker registry credentials on any machine or CI runner that installed an affected version.
  • Audit repository Actions workflows for comment-triggered or pull_request_target-triggered jobs that mint OIDC publish tokens without a manual approval gate — this is the second Mini Shai-Hulud wave in 2026 to abuse exactly this pattern (see TeamPCP’s Wave 4 against TanStack in May, CVE-2026-45321). If your release pipeline lets a PR comment reach a trusted-publishing token, it needs a human in the loop before it fires.
  • Watch for newly created public repositories on your org’s GitHub accounts with generic or templated descriptions — a recurring Shai-Hulud exfiltration pattern.

Sources