npm Supply-Chain Compromise: @7nohe/openapi-react-query-codegen Ships "Trinitite" Credential-Harvesting Worm

npm Supply-Chain Compromise (TL-2026-2193), also tracked as Trinitite, is a critical-severity supply-chain compromise, first published 2026-08-28. It is attributed to TeamPCP with low confidence, affects 7nohe (independent open-source maintainer, npm), maps to 20 MITRE ATT&CK techniques (T1003.007, T1021.004, T1027), and is covered by 9 detection rules and 27 indicators of compromise.

Key facts for TL-2026-2193

Threat ID
TL-2026-2193
Also known as
Trinitite
Severity
CRITICAL
Status
ACTIVE
Category
SUPPLY_CHAIN
First published
2026-08-28
Last reviewed
2026-08-28
Attribution
TeamPCP
Attribution confidence
LOW
Motivation
FINANCIAL
Target sectors
technology, softwaredevelopment, saas, cloudinfrastructure
Target regions
Global
Detection rules
9
Indicators of compromise
27

Malware and tooling in npm Supply-Chain Compromise

Malware and tooling: Trinitite

All ten maintained release lines of @7nohe/openapi-react-query-codegen (~150,000 weekly downloads) were published with a 5.6MB obfuscated JavaScript loader after attackers abused a comment-triggered, OIDC-backed npm publish workflow that failed to verify the commenter's repository association. The malware, self-branded "Trinitite," harvests cloud/registry/CI/AI-agent credentials, poisons npm/PyPI/RubyGems/JFrog, propagates over SSH, and persists via LaunchAgents/systemd, exfiltrating encrypted data through attacker-controlled GitHub repositories.

How npm Supply-Chain Compromise works

On 2026-08-28, Socket's Threat Research Team disclosed that @7nohe/openapi-react-query-codegen, a widely used React Query/TanStack Query code generator, had all ten of its maintained release lines (0.5.4-0.5.5, 1.6.3-1.6.4, 2.2.1-2.2.2, 3.0.3-3.0.4, plus two 0.0.0-<commit> prereleases) published in two waves roughly 20 minutes apart carrying a malicious payload. The attackers exploited a comment-triggered GitHub Actions publish workflow that gated only on the literal text "npm publish" without verifying the commenter's repository association, allowing an untrusted GitHub account to publish contents from a fork (github.com/p00paboot/openapi-react-query-codegen) under the legitimate repository's OIDC trusted-publishing identity. Because the resulting npm provenance attestations record the clean v3.0.2 commit on refs/heads/main, the malicious releases carry valid provenance and defeat `npm audit signatures` as a standalone control.

Execution is triggered without a conventional preinstall/postinstall script in most versions: an obfuscated `binding.gyp` uses Python object/class-hierarchy traversal to reach `os.system()` during node-gyp's native-build step, launching a single-byte-XOR-obfuscated ~5.7MB JavaScript file (`3FWCvzduYZg.js`). A later wave adds a direct `"preinstall": "node 3FWCvzduYZg.js"` trigger, and prerelease builds use alternate loaders (`is_it_this_simple.js`, `nu.js`) via a Bun-based installer path. At runtime the loader decrypts an embedded AES-128-GCM payload to a randomly named temp file, executes it with `child_process.execSync`, and deletes it immediately after.

The payload, which self-identifies in strings as "Trinitite: Sponsored by Preview 2 Effects," systematically harvests AWS (IMDSv2/instance-role/web-identity tokens), Azure (Microsoft Graph tenant/object/client data), GCP metadata/service-account tokens, and HashiCorp Vault secrets; validates and steals npm, PyPI, RubyGems, and JFrog Artifactory tokens; scrapes GitHub tokens and Actions secrets; and targets AI coding-agent configuration for Claude, GitHub Copilot, Cursor, Cline, and Aider. Discovery uses filesystem scanning of up to 12,000 files, `/proc/<pid>/mem` process-memory scraping on Linux, environment-variable enumeration, and cloud metadata probing. Confirmed secrets are used to poison other packages the victim can write to: npm/JFrog tarballs are modified and republished; owned RubyGems are downloaded, re-packed, and resubmitted; and PyPI typosquats are generated (up to 20 suffix variants such as `-mcp`/`-mpc`) and uploaded when the payload's `TYPO_MODE` flag is set. Where GitHub push access exists, the malware injects `.github/_index.js` and a deployment-triggered workflow named "ClaudeCode Review" that serializes repository secrets into an exfiltrated artifact, and separately propagates laterally over noninteractive SSH (`StrictHostKeyChecking=no`, `PasswordAuthentication=no`), SCP-ing `ai_setup.sh`/`ai_init.js` to reachable hosts and executing the implant remotely.

Host persistence is established via a macOS LaunchAgent (`~/Library/LaunchAgents/com.user.sysvinit-detect-fash.plist`, RunAtLoad/KeepAlive) or a Linux systemd user service with lingering enabled (`~/.config/systemd/user/sysvinit-detect-fash.service`), plus injected hook commands in VS Code/Cursor/Aider configuration that re-trigger the payload at session start. Collected data is chunked at 102,400 bytes, gzip-compressed, and encrypted with AES-256-GCM under an RSA-OAEP-wrapped key before being committed to newly created, randomly Touhou-themed public GitHub repositories for exfiltration. A separate command channel polls GitHub commit search hourly for the query `firedalazer`, parsing messages formatted `n1ggatr1n <base64-url>.<base64-signature>`, verifying them with RSA-PSS/SHA-256 against an embedded public key, and executing the resulting Python commands; a companion token-monitor polls the GitHub API once per minute for up to 259,200 seconds (72 hours) and `eval`s a stored shell handler on receiving an HTTP 4xx response.

Socket notes material behavioral overlap with Microsoft's "Mini Shai-Hulud" campaign lineage (npm delivery, obfuscated bundles, Bun loaders, credential harvesting, GitHub Actions abuse, package poisoning, GitHub-hosted exfiltration) but explicitly declines to confirm shared operators. Independent analysis from Aikido Security ties the incident's "Trinitite" branding and binding.gyp sandbox-escape technique to possible TeamPCP involvement — notable because two alleged TeamPCP members were arrested in Western Australia on 2026-08-26, two days before this compromise was published, leaving open whether this is a copycat, a surviving affiliate, or an unrelated actor. No CVE or GHSA identifier had been assigned at time of publication, and all ten malicious versions remained installable when Socket's report went live.

MITRE ATT&CK techniques used in TL-2026-2193

Credential Access

T1003.007 OS Credential Dumping: Proc Filesystem; T1528 Steal Application Access Token; T1552.001 Unsecured Credentials: Credentials In Files; T1552.005 Unsecured Credentials: Cloud Instance Metadata API

Lateral Movement

T1021.004 Remote Services: SSH; T1570 Lateral Tool Transfer

Defense Evasion

T1027 Obfuscated Files or Information; T1070.004 Indicator Removal: File Deletion; T1140 Deobfuscate/Decode Files or Information

Execution

T1059.004 Command and Scripting Interpreter: Unix Shell; T1059.006 Command and Scripting Interpreter: Python; T1059.007 Command and Scripting Interpreter: JavaScript

Command and Control

T1102.002 Web Service: Bidirectional Communication; T1573.002 Encrypted Channel: Asymmetric Cryptography

Initial Access

T1195.001 Supply Chain Compromise: Compromise Software Dependencies and Development Tools; T1195.002 Supply Chain Compromise: Compromise Software Supply Chain

Persistence

T1543.001 Create or Modify System Process: Launch Agent; T1543.002 Create or Modify System Process: Systemd Service

Collection

T1560.001 Archive Collected Data: Archive via Utility

Exfiltration

T1567.001 Exfiltration Over Web Service: Exfiltration to Code Repository

Affected products and versions in npm Supply-Chain Compromise

  • 7nohe (independent open-source maintainer, npm) — @7nohe/openapi-react-query-codegen
    Vulnerable versions: 0.5.4; 0.5.5; 1.6.3; 1.6.4; 2.2.1; 2.2.2; 3.0.3; 3.0.4; 0.0.0-365d4eb738d3146583431948d3ba6e27a32556be; 0.0.0-ec7876d6c917dad516ba69bbfafc948b834bf0ab
    Fixed in: 0.5.3; 1.6.2; 2.2.0; 3.0.2

Remediation for npm Supply-Chain Compromise

Patches

  • No official patched release exists yet; the only current remediation is rollback to the pre-compromise versions 0.5.3, 1.6.2, 2.2.0, or 3.0.2

Immediate actions

  • Pin or roll back to the last known-clean releases (0.5.3, 1.6.2, 2.2.0, 3.0.2) and purge all ten malicious versions (0.5.4, 0.5.5, 1.6.3, 1.6.4, 2.2.1, 2.2.2, 3.0.3, 3.0.4, and the two 0.0.0-<commit> prereleases) from lockfiles, artifact caches, and CI runner images
  • Rotate every credential reachable from any host that ran `npm install` against the affected package: npm/PyPI/RubyGems/JFrog tokens, GitHub PATs and Actions secrets, AWS/Azure/GCP instance credentials, and HashiCorp Vault tokens
  • Hunt for and remove persistence artifacts: the LaunchAgent com.user.sysvinit-detect-fash.plist, the systemd user service sysvinit-detect-fash.service, ~/.local/bin/sysvinit-detect-fash.sh, and injected startup hooks in VS Code/Cursor/Aider configuration
  • Audit repositories reachable by any exposed GitHub token for the injected .github/_index.js file, a workflow named "ClaudeCode Review", and any newly created public repositories with Touhou-themed names
  • Check outbound network/API logs for GitHub commit-search queries containing "firedalazer" and hourly GitHub API polling patterns, which indicate an active C2 channel

Workarounds

  • Block or pin @7nohe/openapi-react-query-codegen via a registry proxy/allowlist to exclude 0.5.4-0.5.5, 1.6.3-1.6.4, 2.2.1-2.2.2, 3.0.3-3.0.4, and both 0.0.0-<commit> prereleases
  • Disable automatic node-gyp rebuild for third-party/untrusted packages in CI runners until dependency install is sandboxed

Longer-term hardening

  • Require branch/reviewer-scoped approval — not a bare comment string like "npm publish" — before any comment-triggered CI/CD workflow can run with OIDC trusted-publishing credentials, and verify commenter repository association
  • Sandbox npm install/build steps (disable node-gyp command-substitution execution, deny network egress during install) in both CI and developer environments
  • Treat npm provenance attestations as necessary but not sufficient; pair them with behavioral/runtime scanning of install-time execution, since these releases carried fully valid provenance

Weaknesses (CWE) in npm Supply-Chain Compromise

CWE-506, CWE-829, CWE-1357

Timeline of npm Supply-Chain Compromise

  • Microsoft publishes 'Shai-Hulud 2.0' guidance covering the broader self-propagating npm worm lineage that Socket later compares this incident's behavior against.
  • Microsoft Security Blog reports 'Mini Shai-Hulud,' a resurgence compromising 170+ npm packages and 2 PyPI packages via CI/CD credential theft, establishing the campaign lineage Socket flags as behaviorally similar to this incident.
  • Australian Federal Police, the FBI, and Western Australia Police arrest two alleged TeamPCP members (aged 21 and 23) in Cottesloe and Mandurah, WA; the 23-year-old is charged with six computer-related offences tied to prior supply-chain attacks.
  • Security outlets (Help Net Security, BleepingComputer, The Hacker News, CyberScoop) report the TeamPCP arrests, describing over 1,000 organizations compromised, roughly 500,000 credentials stolen, and at least 300GB exfiltrated across TeamPCP's prior campaigns.
  • Aikido Security publishes independent corroborating analysis identifying the malware's self-branding string 'Trinitite: Sponsored by Preview 2 Effects' and detailing the binding.gyp Python sandbox-escape execution vector, while flagging a possible but unconfirmed TeamPCP link despite the arrests two days earlier.
  • Socket's Threat Research Team discovers and publicly discloses the compromise, publishing malware mechanics, credential-harvesting scope, persistence artifacts, and file-hash IOCs.
  • The npm 'latest' dist-tag comes to point at compromised version 3.0.4; all ten malicious releases (0.5.4-0.5.5, 1.6.3-1.6.4, 2.2.1-2.2.2, 3.0.3-3.0.4, plus 2 prereleases) remain installable.
  • Attackers exploit a comment-triggered, OIDC-backed npm publish GitHub Actions workflow on @7nohe/openapi-react-query-codegen that fails to verify commenter repository association, publishing 10 malicious version lines from a fork (github.com/p00paboot/openapi-react-query-codegen) in two waves roughly 20 minutes apart.

Sources cited for npm Supply-Chain Compromise

More in supply chain

Detection coverage for TL-2026-2193

As of 2026-08-28, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2193 across Splunk SPL, Microsoft KQL and Sigma, covering 27 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Further reading

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats