Trinitite Worm Infects 10 Versions of TanStack Query Code Generator
Summary
Aikido reports that Trinitite compromised 10 versions of an npm code generator, using a binding.gyp sandbox escape to run a credential-stealing worm that spreads through package registries and GitHub repositories.
Key points
- Aikido reports 10 compromised versions of @7nohe/openapi-react-query-codegen were published within 20 minutes; the package has more than 150,000 weekly downloads.
- The primary install hook abuses Python expressions in binding.gyp, evaluated by node-gyp, to execute a shell command without a package.json preinstall script.
- The obfuscated payload targets developer, cloud, and infrastructure credentials, including GitHub, npm, AWS, Azure, GCP, Vault, and Kubernetes credentials.
- Stolen credentials are used to create public GitHub repositories containing encrypted credential bundles, and to propagate the worm through npm, PyPI, and RubyGems packages.
- The worm also poisons accessible GitHub repositories with backdoor configurations for developer tools and a fake CodeQL workflow.
- Aikido says the payload checks for security tools, scanner decoy credentials, and research environments before proceeding; it lists affected package versions and file hashes as indicators.
Article Details
- Attack Vectors
- Compromised GitHub Actions workflow was used to publish malicious versions of @7nohe/openapi-react-query-codegen to npm with valid but unreliable provenance attestations.
- A malicious binding.gyp condition uses a Python sandbox escape to execute a Node.js payload during package installation; two prerelease versions instead use preinstall scripts.
- The payload checks locale, security-tool directories, working-directory paths, environment variables, repository owners, and StepSecurity harden-runner activity before continuing.
- Trinitite harvests credentials from environment variables, local configuration and credential files, cloud metadata endpoints, and service-account locations.
- Using stolen npm, PyPI, and RubyGems credentials, the worm enumerates packages and publishes versions containing a malicious binding.gyp and payload.
- Using stolen GitHub tokens, the worm poisons accessible repositories with backdoored editor and developer-tool configuration files and a fake CodeQL workflow.
- Stolen credentials are encrypted and committed as JSON files to public GitHub repositories created using a token recovered from public commit history.
- Defensive Notes
- The article recommends checking Aikido’s central feed for malware issues and triggering a manual rescan rather than waiting for the nightly rescan.
- The article describes Aikido Safe Chain as intercepting npm, npx, yarn, pnpm, and pnpx commands and checking packages before installation.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| SHA256 | 59370c67b54a0ccaedd265e2356f04540b2fba1e1845300ef6de4d5437d99380 | SHA-256 hash listed for a malicious file in the compromised package. |
| SHA256 | 709af2fdeb50324229e94c44c679a0fab18bd8e17d3864405989c526cbb63ad8 | SHA-256 hash listed for a malicious file in the compromised package. |
| SHA256 | 778d6f0058045d6a2ab9a7e1d3e3be8e7e6b4d9cc217d13949bf1dfbab759a7c | SHA-256 hash listed for a malicious file in the compromised package. |
| SHA256 | 8e5d1af68ca340ae0c6e8132cb00c686ec2d60502c1994d94ce353d1472ad5a3 | SHA-256 hash listed for the malicious package file 3FWCvzduYZg.js. |
| SHA256 | b24d121667f21f492cb9db34fbfd515d5922a8dd30b9c45215c7220abbb10ca8 | SHA-256 hash listed for a malicious file in the compromised package. |
| SHA256 | b49afb7dba04cd99b357ce7c652c823a3707f28e130bd5c6645851a7adc030d6 | SHA-256 hash listed for a malicious file in the compromised package. |
| SHA256 | b6012b2ff87f08f93ee53921c48db907ddbcf5461b03bb988083b01a36886237 | SHA-256 hash listed for a malicious file in the compromised package. |
| SHA256 | e1f1162ece9a6e6ea21a20399cbf31c563a8149d433a68711f4223870c203d5a | SHA-256 hash listed for a malicious file in the compromised package. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe payload uses multiple encryption and obfuscation layers, including XOR, AES-128-GCM, and a custom shuffled-table cipher.T1059.004 · Unix ShellThe binding.gyp escape invokes os.system to run the Node.js payload; one prerelease also downloads Bun using wget piped to bash.T1059.006 · PythonThe binding.gyp condition executes a Python expression that escapes the sandbox and launches the payload.T1059.007 · JavaScriptThe package-install hooks and payload use Node.js to execute JavaScript files.T1083 · File and Directory DiscoveryThe malware scans more than 150 filesystem glob patterns to locate credentials and other data.T1105 · Ingress Tool TransferThe initial script downloads the Bun runtime before using it to run the encrypted payload.T1195.002 · Compromise Software Supply ChainThe attacker compromised a GitHub Actions workflow and published malicious versions of the npm package.T1528 · Steal Application Access TokenThe payload searches for and steals GitHub, npm, PyPI, and RubyGems access tokens, including a GitHub Actions OIDC token.T1552.001 · Credentials In FilesThe payload searches local configuration and credential files, including .npmrc, cloud credentials, SSH keys, and Git credentials.T1552.005 · Cloud Instance Metadata APIThe payload queries AWS and Azure instance metadata endpoints for credentials.T1567.001 · Exfiltration to Code RepositoryThe malware exfiltrates encrypted credential bundles by committing them to public GitHub repositories.
Malware
Vendors
GitHubBoth the npm package and its corresponding GitHub repository appear to have been compromised. The attacker gained access by exploiting a vulnerability in one of the project's GitHub Actions workflows. Therefore, allnpmin Australia, and we have now detected a new TeamPCP-like malware hitting 10 versions of a popular npm package called @7nohe/openapi-react-query-codegen (+150,000 weekly downloads). These versions were all
Products
@7nohe/openapi-react-query-codegennow detected a new TeamPCP-like malware hitting 10 versions of a popular npm package called @7nohe/openapi-react-query-codegen (+150,000 weekly downloads). These versions were all published to npm in a span of 20GitHub Actionsbeen compromised. The attacker gained access by exploiting a vulnerability in one of the project's GitHub Actions workflows. Therefore, all releases come with valid provenance attestations. These are cryptographicTanStack Querywere all published to npm in a span of 20 minutes. The package in question generates type-safe TanStack Query hooks directly from an OpenAPI schema, saving developers from writing boilerplate code by hand.