Mini Shai-Hulud hits openapi-react-query-codegen: 10 malicious npm versions
Brief
On August 28, 2026, ten malicious versions of @7nohe/openapi-react-query-codegen were published to npm between 20:00 and 20:21 UTC. The package generates React Query hooks from an OpenAPI schema and draws roughly 150,000 weekly downloads. The latest tag pointed at the malicious 3.
- 4 for the duration of the window.
Eight of the ten releases carry a multi-stage loader that reaches for cloud, registry, and developer credentials. The attacker needed no stolen npm token and no hijacked maintainer account. They commented on a pull request.
How the attacker got published
The release workflow ran on issue_comment events and gated only on the text of the comment.