A JavaScript development package has been caught in a supply-chain compromise that can run malicious code when installed. The incident affects a tool with about 150,000 weekly downloads, risking developer and automated build systems.

Attackers published ten tainted releases on August 28 in two bursts. They covered every maintained version line, and a routine dependency update could become an entry point for credential theft.

The malicious code runs during installation through build configuration abuse and, in some releases, a pre-install command.

Socket.dev said in a report shared with Cyber Security News (CSN) that it unlocks a hidden program that searches for credentials in files, processes, cloud services, and continuous-integration environments.

Socket.dev analysts identified the activity as an ongoing Mini Shai-Hulud compromise. It can reuse stolen access and alter build environments, potentially turning an installation into a wider supply-chain problem.

Popular npm Package With 150K Weekly Downloads

The package generates code that connects applications with APIs. Malicious releases carried valid npm provenance records, meaning proof that an approved workflow built a package did not reveal malicious code in the release.

The compromised versions were signed through GitHub Actions trusted publishing. Researchers found that a release workflow could be triggered by a comment on a pull request, then checked out code from that pull request’s fork and published it with the trusted identity.

The workflow did not verify that the commenter was a trusted repository contributor. Provenance can show which automated workflow produced an artifact, but cannot confirm that it built safe source code.

The teams should review safeguards around publishing jobs, especially workflows that react to external comments while holding permissions to publish packages or obtain identity tokens.

Execution Path (Source - Socket.dev) — Execution Path (Source – Socket.dev)

The installation route echoes the technique described in this earlier binding.gyp supply-chain incident, where build metadata activated code outside the lifecycle scripts that many checks focus on.

Here, the implanted program was hidden inside a scrambled JavaScript file and launched through the native-build path.

Credential Theft and Containment Steps

Once active, the payload searches project files, process memory, cloud metadata services, and CI variables for access tokens and other secrets.

It checks whether stolen credentials work, collects the results in encrypted form, and stores them in attacker-created public GitHub repositories. This can expose code-hosting, package-registry, cloud, and developer-tool access at once.

The malware also alters GitHub Actions workflows, monitors tokens on macOS and Linux, and adds background commands to AI coding-assistant settings.

It can use reachable SSH hosts for propagation and poison packages under writable registry scopes. Its behavior resembles the credential-led spread covered in the earlier Shai-Hulud supply-chain attack, though overlap alone does not prove the same operators are responsible.

The organizations should treat an installation of an affected release as a possible host compromise. Teams should isolate the machine or runner first, preserve evidence, neutralize persistence, and only then revoke or test exposed tokens, because the monitor may react when a stored GitHub token returns an error.

Affected environments should be rebuilt from a known-clean image where practical. After containment, administrators should rotate accessible package, GitHub, cloud, CI, and developer-tool credentials, inspect lockfiles and software bills of materials for direct and indirect use, clear caches, and reinstall from a clean lockfile pinned to a known-good release.

Security teams should review repository creation, workflow changes, deployment activity, suspicious dependency-update commits, and unexpected artifacts.

Related reporting on compromised GitHub Actions secrets shows why CI runners deserve the same incident-response urgency as employee endpoints. Maintainers should require trusted-contributor checks before a comment-triggered workflow can publish code.

This case reinforces the lesson from the Keyv npm package compromise: dependency trust cannot rest on a registry signature or provenance record alone.

Reviewing release triggers, locking dependencies, and limiting token privileges can reduce the blast radius when a trusted publishing path is abused.

Indicators of compromise (IoCs):-

Type	Indicator	Description
Malicious npm package	`@7nohe/openapi-react-query-codegen`	Compromised npm package
Malicious npm versions	`0.0.0-365d4eb738d3146583431948d3ba6e27a32556be` `0.0.0-ec7876d6c917dad516ba69bbfafc948b834bf0ab` `0.5.4` `0.5.5` `1.6.3` `1.6.4` `2.2.1` `2.2.2` `3.0.3` `3.0.4`	Malicious published package releases
Threat actor GitHub account	`github[.]com/p00paboot`	Account associated with staging activity
Threat actor repository	`github[.]com/p00paboot/openapi-react-query-codegen`	Fork used to stage malicious code
Malicious commit	`365d4eb738d3146583431948d3ba6e27a32556be`	Commit associated with the malicious staging activity
Malicious file	`3FWCvzduYZg.js`	Obfuscated JavaScript payload
Malicious build file	`binding.gyp`	Build configuration used for execution
Payload files	`ai_init.js` `ai_setup.sh` `is_it_this_simple.js`	Files linked to payload loading and execution
Persistence files	`~/.local/bin/sysvinit-detect-fash.sh` `~/.config/sysvinit-detect-fash/fox` `~/.config/sysvinit-detect-fash/fash-detected` `~/.config/sysvinit-detect-fash/runit`	Linux persistence-related artifacts
Persistence files	`~/Library/LaunchAgents/com.user.sysvinit-detect-fash.plist` `~/.config/systemd/user/sysvinit-detect-fash.service`	macOS LaunchAgent and Linux systemd persistence artifacts
Local artifacts	`/var/tmp/.shit` `/tmp/.sshu-` `/tmp/pcfg/` `.config/index.js` `.github/_index.js`	Files and paths associated with payload execution, tracking, and persistence
SHA-256	`b49afb7dba04cd99b357ce7c652c823a3707f28e130bd5c6645851a7adc030d6` `59370c67b54a0ccaedd265e2356f04540b2fba1e1845300ef6de4d5437d99380`	Hashes for `3FWCvzduYZg.js`
SHA-256	`d3246926b20a8d021ed7de0ac8e9eee1dda986088f84ba18f31cb2042a121f5d`	Hash for `binding.gyp`
Execution indicator	`preinstall: node 3FWCvzduYZg.js`	Pre-install execution instruction
Environment indicator	`WORKFLOW_ID=release.yml` `REPO_ID_SUFFIX=7nohe/openapi-react-query-codegen` `TARGET_PACKAGES=@7nohe/openapi-react-query-codegen`	Environment values used in malicious execution paths
Legitimate service abuse, do not block solely	`https://github.com/` `https://github.com/oven-sh/bun/releases/download/bun-v1.4.0/` `https://api.github.com/` `https://api.github.com/user` `https://api.github.com/search/commits`	Legitimate GitHub infrastructure abused by the payload
Legitimate service abuse, do not block solely	`https://registry.npmjs.org/` `https://registry.npmjs.org/-/npm/v1/tokens` `https://registry.npmjs.org/-/whoami` `https://registry.npmjs.org/-/org/` `https://registry.npmjs.org/-/v1/oidc/token/exchange/package/`	npm endpoints referenced for credential validation and publishing activity
Legitimate service abuse, do not block solely	`https://upload.pypi.org/` `https://upload.pypi.org/legacy/` `https://pypi.org/` `https://pypi.org/pypi/`	PyPI endpoints referenced by the payload
Legitimate service abuse, do not block solely	`https://rubygems.org/` `https://rubygems.org/api/v1/api_key.json` `https://rubygems.org/api/v1/gems.json?page=` `https://rubygems.org/api/v1/gems/`	RubyGems endpoints referenced by the payload
Legitimate service abuse, do not block solely	`http://169.254.169.254/` `http://169.254.169.254/latest/api/token` `http://169.254.170.2/` `http://metadata.google.internal/` `https://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token`	Cloud metadata endpoints targeted for credential discovery
Legitimate service abuse, do not block solely	`https://graph.microsoft.com/` `https://graph.microsoft.com/v1.0/servicePrincipals` `https://management.azure.com/` `https://login.microsoftonline.com/` `https://vault/`	Microsoft Azure and Vault endpoints referenced by the payload
Legitimate service abuse, do not block solely	`https://fulcio.sigstore.dev/` `https://rekor.sigstore.dev/` `https://search.sigstore.dev/` `https://cdn.bsky.app/`	Other legitimate endpoints observed in the reported activity

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC