Khoury College of Computer Sciences
CS 4550 / CS 5610 · Web Development · Fall 2026
TanStack Query OpenAPI codegen hit by npm supply-chain worm
- Security
- React
- Course
Instructor-curated digest, not original reporting. Each post paraphrases a public article and links to the original source.
On August 28, 2026, Ilyas Makari at Aikido reported that ten versions of @7nohe/openapi-react-query-codegen (a popular generator of type-safe TanStack Query hooks from OpenAPI, 150k+ weekly downloads) were published to npm in about 20 minutes with malware branded Trinitite. Both the npm package and GitHub repo were compromised via a GitHub Actions workflow vulnerability, so releases still carried valid provenance attestations from the official workflow.
Install-time execution used a binding.gyp Python sandbox escape (and sometimes a preinstall script) to run a multi-megabyte Node payload that harvests GitHub, npm, cloud, and local credentials, exfiltrates encrypted bundles to public GitHub repos, and worms into other packages the stolen tokens can publish. Aikido lists the affected version numbers and file hashes; check whether those versions appear in lockfiles and rotate tokens if they do.
Dependency hygiene on npm packages is the same Node server and package work as Chapter 5, on the React data-fetching stack you meet alongside Chapter 1.
Read original: Popular code generator for TanStack Query hit by supply chain worm — Aikido