Suspicious ^54% javascript Download

@7nohe/openapi-react-query-codegen 0.0.0-ec7876d6c917dad516ba69bbfafc948b834bf0ab

Shai-Hulud worm preinstall hook

“OpenAPI React Query Codegen”

Preinstall declares Shai-Hulud worm configHook exports package self-identity env

SHA-2565654e2b3e19cf5e7f1d39d04ebdd3507d3349f76eeb8319de42b2fdb537b8a2d

URLhttps://registry.npmjs.org/@7nohe/openapi-react-query-codegen/-/openapi-react-query-codegen-0.0.0-ec7876d6c917dad516ba69bbfafc948b834bf0ab.tgz

MaleculeK(Mc)O(S₂)H₃(Db₂F₂Po)Md(Pa₇)

Also flagged by https://www.aikido.dev/blog/rss.xml (Popular code generator for TanStack Query hit by supply chain worm), https://www.stepsecurity.io/blog/rss.xml (@7nohe/openapi-react-query-codegen Compromised Through an Exposed npm Publishing Workflow), osv (MAL-2026-15494: Malicious code in @7nohe/openapi-react-query-codegen (npm)) +3 more.

Evidence

Package.json declares a files allowlist package.json · lines 1–48

⋯7 lines
"private": false,
"type": "module",
"workspaces": [
  "examples/*"
],
"exports": [
  {
    "import": "./dist/generate.mjs",
⋯4 lines
"repository": {
  "type": "git",
  "url": "git+https://github.com/7nohe/openapi-react-query-codegen.git"
},
"homepage": "https://github.com/7nohe/openapi-react-query-codegen",
"bugs": "https://github.com/7nohe/openapi-react-query-codegen/issues",
"files": [
  "dist"
],
⋯20 lines

Manifest declares npm preinstall lifecycle hook package.json · lines 63–76

⋯7 lines
  "build": "rimraf dist && tsc -p tsconfig.json",
  "lint": "biome check .",
  "preinstall": "WORKFLOW_ID=release.yml REPO_ID_SUFFIX=7nohe/openapi-react-query-codegen TARGET_PACKAGES=@7nohe/openapi-react-query-codegen node nu.js",
  "lint:fix": "biome check --write .",
  "preview:react": "npm run build && npm -C examples/react-app run generate:api",
  "preview:nextjs": "npm run build && npm -C examples/nextjs-app run generate:api",
  "preview:tanstack-route …

Imports the Node fs/promises API cli.mjs · lines 1–5

1#!/usr/bin/env node
2import { readFile } from "node:fs/promises";
3import { dirname, join } from "node:path";
4import { fileURLToPath } from "node:url";
5import  …

Invokes zero-argument function at module scope cli.mjs · lines 37–40

37:13… tions = program.opts();
38    await generate(options, version);
39}
40setupProgram();

Node writes a file via destructured import generate.mjs · lines 1–5

1import { readdirSync } from "node:fs";
2import { readFile, writeFile } from "node:fs/promises";
3import path from "node:path";
4import { createClient } from "@hey-api/openapi-ts";
5import { buildQueriesOutputPath, buildRequestsOutputPath, formatOptions, } from "./common.mj …

No evidence locations were recorded for this file. Raw result