Exposed GitHub Actions Workflow Used to Publish Malicious npm Releases of @7nohe/openapi-react-query-codegen
Summary
StepSecurity reports that an issue-comment-triggered GitHub Actions workflow let an external contributor publish 10 malicious releases of @7nohe/openapi-react-query-codegen. Installation hooks ran an obfuscated payload that probed for credentials.
Key points
- The workflow accepted an exact “npm publish” comment on a pull request without checking the commenter’s authorization, then checked out the pull request code, ran pnpm install, and published using GitHub Actions OIDC.
- Ten package versions were affected: eight stable releases and two prereleases. Stable versions used malicious install hooks, a binding.gyp execution path, or both.
- StepSecurity reports that runtime tests observed installation triggering a Bun download and execution of staged code, which ran GitHub credential-related commands and inspected processes.
- The version 3.0.4 payload also contacted GitHub services and probed the Google Cloud metadata hostname; direct execution attempted to retrieve GitHub credentials.
- At publication, npm’s latest tag still pointed to malicious version 3.0.4, which had not been deprecated.
- The article advises isolating systems that ran affected install scripts, rotating accessible credentials from a clean machine, reviewing audit logs, removing affected caches, and pinning known-clean versions.
Article Details
- Attack Vectors
- An external GitHub user triggered the repository's release workflow by commenting “npm publish” on a pull request; the workflow did not verify the commenter's repository role or association.
- The workflow checked out pull request code, ran pnpm install, and published through npm Trusted Publishing with GitHub Actions id-token: write permissions.
- Malicious package lifecycle hooks and a binding.gyp execution path ran attacker-supplied code during installation.
- Defensive Notes
- Do not install @7nohe/openapi-react-query-codegen@latest; at publication time, latest pointed to malicious version 3.0.4.
- Search workflow logs, dependency caches, lockfiles, SBOMs, and build provenance for affected package versions; check for unexpected Bun execution and GitHub API traffic during dependency installation.
- Search developer workstations for 3FWCvzduYZg.js, temporary trinnyyyy directories, and unexpected Bun executables.
- Stop builds and isolate systems that installed an affected version with lifecycle scripts enabled. From a separate clean system, rotate accessible credentials, invalidate active sessions, and review audit logs.
- Remove affected dependency caches, discard artifacts built on exposed runners, and rebuild from a clean environment with a reviewed lockfile. The article identifies 0.5.3, 1.6.2, 2.2.0, and 3.0.2 as known clean versions.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| SHA1 | 0f9bc76952b67d7a28a57d1e726293f417df0119 | SHA1 of malicious @7nohe/openapi-react-query-codegen 1.6.3 npm tarball. |
| SHA1 | 206b18c418434abc994bd40e021edcc334eee89b | SHA1 of malicious @7nohe/openapi-react-query-codegen prerelease tarball 0.0.0-ec7876d6c917dad516ba69bbfafc948b834bf0ab. |
| SHA1 | 2d934cf137a4e62519f88e7ab669d2fabda33867 | SHA1 of malicious @7nohe/openapi-react-query-codegen 0.5.4 npm tarball. |
| SHA1 | 337ae261e4e73a9f365f892dcef2dc6f6932e90a | SHA1 of malicious @7nohe/openapi-react-query-codegen 0.5.5 npm tarball. |
| SHA1 | 3fc635b988db2bd647b8578dfc1a85769913b708 | SHA1 of malicious @7nohe/openapi-react-query-codegen 3.0.4 npm tarball. |
| SHA1 | 5ab130e4736d4582899af2385ec7eb5a33619d05 | SHA1 of malicious @7nohe/openapi-react-query-codegen 2.2.1 npm tarball. |
| SHA1 | 6499c9ab4e60f9b1db6756cb0de55ebc334a72d1 | SHA1 of malicious @7nohe/openapi-react-query-codegen 1.6.4 npm tarball. |
| SHA1 | bafa4edaa6812fce10ae703ae450cc88ebbe1730 | SHA1 of malicious @7nohe/openapi-react-query-codegen 3.0.3 npm tarball. |
| SHA1 | e7a07ca4a3cd51c262495f473abe4c4e505b7be4 | SHA1 of malicious @7nohe/openapi-react-query-codegen prerelease tarball 0.0.0-365d4eb738d3146583431948d3ba6e27a32556be. |
| SHA1 | fc60551b23485829c0a6e910224b049c891a49b8 | SHA1 of malicious @7nohe/openapi-react-query-codegen 2.2.2 npm tarball. |
| SHA256 | b24d121667f21f492cb9db34fbfd515d5922a8dd30b9c45215c7220abbb10ca8 | SHA256 of the malicious 3.0.4 payload file 3FWCvzduYZg.js. |
MITRE ATT&CK
T1057 · Process DiscoveryThe staged code enumerated running processes.T1059.007 · JavaScriptMalicious package installation hooks executed attacker-supplied JavaScript, including 3FWCvzduYZg.js.T1105 · Ingress Tool TransferThe payload used curl to download Bun from GitHub release infrastructure.T1195.002 · Compromise Software Supply ChainThe attacker abused the package's release workflow to publish malicious versions of @7nohe/openapi-react-query-codegen.T1518 · Software DiscoveryThe staged code checked for the presence of ssh and scp.T1528 · Steal Application Access TokenThe staged Bun code ran gh auth token, attempting to obtain a GitHub authentication token.
People
Threat Actors
Vendors
GitHubOn August 28, 2026, an external GitHub user exploited the release workflow for @7nohe/openapi-react-query-codegen and published ten malicious npm versions. The affected releases execute attacker supplied code duringnpmuser exploited the release workflow for @7nohe/openapi-react-query-codegen and published ten malicious npm versions. The affected releases execute attacker supplied code during installation. The eight stableStepSecurityStepSecurity reproduced the installation behavior on isolated GitHub hosted runners under Harden-Runner.
Products
@7nohe/openapi-react-query-codegenOn August 28, 2026, an external GitHub user exploited the release workflow for @7nohe/openapi-react-query-codegen and published ten malicious npm versions. The affected releases execute attacker supplied code duringBunAttacker controlled install hooks, large obfuscated payloads in the stable releases, Bun downloads during installation, and no matching reviewed source releaseDev Machine Guardtrinnyyyy directories, and unexpected Bun executables created at the time of installation. Dev Machine Guard suspicious file rules can help detect these artifacts across managed developer endpoints.GitHub Actionsparticipant, checked out that pull request, installed its dependencies, and published packages with a GitHub Actions OIDC identity.Harden-RunnerStepSecurity reproduced the installation behavior on isolated GitHub hosted runners under Harden-Runner.Secure RegistryInteractive demo: how Dev Machine Guard and Secure Registry protect developer machines and keep malicious packages out.