TanStack Query npm package targeted via compromised OpenAPI code generator on npm

Home » JavaScript » npm » TanStack Query npm package targeted via compromised OpenAPI code generator on npm

In late August 2026, security researchers uncovered a targeted supply-chain attack linked to the TanStack Query npm ecosystem through a popular OpenAPI code generator. The incident centers on the package @7nohe/openapi-react-query-codegen, a tool that automatically generates type-safe hooks for TanStack Query directly from OpenAPI schemas, and that has been seeing more than 150,000 weekly downloads on npm.

Rather than going after TanStack Query core libraries themselves, the attackers compromised the surrounding tooling that many teams rely on to produce TanStack Query hooks, slipping a complex malware payload into multiple releases of the generator. Because these hooks plug straight into production React and TypeScript codebases, the impact extends well beyond a single package, touching any CI pipeline or developer machine that installed the tainted versions.

How the attack abused a TanStack Query code generator on npm

The affected library, @7nohe/openapi-react-query-codegen, is widely used to scaffold TanStack Query hook layers from OpenAPI contracts, saving teams from hand-writing repetitive fetch logic. Over a period of roughly 20 minutes, an attacker pushed ten malicious versions of this package to the npm registry, all of them bearing valid provenance attestations produced via GitHub Actions.

Those attestations, normally a strong signal of integrity, were rendered meaningless because the project’s GitHub Actions workflow itself had been compromised. By exploiting a vulnerability in that workflow, the threat actor gained the ability to ship trojanized builds while still generating cryptographic evidence that they came from the “official” pipeline. The corresponding GitHub repository appears to have been taken over in the same move, giving the attacker full control of the release process.

The campaign mirrors earlier supply-chain incidents tied to npm but adds a twist: it specifically targets the intersection of OpenAPI tooling and TanStack Query usage. Since the generator emits React code that depends on @tanstack/react-query, any organization that wired it into their automated API client generation runs the risk of having pulled the malware into build agents, CI runners, or developer laptops.

Investigators also noted that the malware’s branding—calling itself “Trinitite: Sponsored by Preview 2 Effects”—echoes the theatrical style of previous TeamPCP-linked operations, though it remains unclear whether this is the work of copycats, a splinter group, or an unrelated actor borrowing the aesthetic.

Binding.gyp sandbox escape: launching malware during npm install

One of the more unusual technical choices in this TanStack Query–adjacent attack is the abuse of binding.gyp as an execution vector during npm install. Under normal circumstances, binding.gyp describes how to compile native Node.js addons. When npm encounters such a file, it invokes node-gyp, which in turn evaluates the conditions field using Python.

The malicious versions of @7nohe/openapi-react-query-codegen exploit this behavior by embedding a Python sandbox escape in the conditions block. Instead of containing harmless build configuration, the file walks Python’s internal class hierarchy to reach the catch_warnings class, pivots to __builtins__, imports os, and finally calls os.system to execute a JavaScript payload with Node.

Once the obfuscation is stripped away, the condition boils down to a single command: node 3FWCvzduYZg.js executed automatically during installation. The rest of the binding.gyp content is effectively a smokescreen: the declared target name is meaningless, the type is hex-encoded none, and no real native compilation occurs.

Not every tainted release relied solely on this trick. Two prerelease tags used conventional preinstall scripts instead, one invoking a local file nu.js and another downloading the Bun runtime via wget piped to bash before starting a script brazenly named is_it_this_simple.js. Later versions doubled up, combining the binding.gyp exploit with an explicit "preinstall": "node 3FWCvzduYZg.js" entry in package.json to maximize the chances the payload would run.

A multi-layered JavaScript payload built to evade sandboxes

At the center of the compromised TanStack Query generator sits 3FWCvzduYZg.js, a single-line file weighing in at roughly 5.4 MB, placed in the root of the npm package. This script is heavily obfuscated, using multiple encryption stages to slow down inspection and to frustrate static analysis tools.

The outermost layer is a giant integer array decrypted via XOR with a fixed key, which reveals code that silently downloads the Bun runtime into a temporary directory (under names like trinnyyyy-XXXXX in the system temp folder). Bun is then used to execute the next encrypted segment, which is stored as AES-128-GCM–protected data embedded inside the script.

Once fully decrypted and deobfuscated, analysts found an inner payload of around 800 KB of JavaScript that functions as a credential stealer, self-spreading worm, and destructive utility. This inner script applies a custom shuffled-table cipher layered on top of well-known obfuscator.io transforms, again signaling that the authors aimed specifically to resist automated reverse engineering.

Before doing any real damage, the malware performs a series of environment checks designed to evade security researchers and automated scanners. It silently exits if it detects Russian system locales, common EDR tools from CrowdStrike, SentinelOne, or Carbon Black, known sandbox directories used by supply-chain scanning products, fake secret prefixes (such as AKIAFAKE or decoy npm tokens), or GitHub organization names associated with security research demos. It also looks for the presence of the StepSecurity harden-runner tool, backing off if it sees that hardened CI configuration.

What the malware tries to steal from TanStack Query users and beyond

Once the execution conditions are met, the payload begins systematically collecting a wide range of credentials commonly present in modern JavaScript and TanStack Query–based workflows. The focus is not on the front-end framework itself, but on the cloud and developer infrastructure that TanStack Query clients typically talk to.

GitHub access is a primary target. The malware searches for both classic personal access tokens and newer fine-grained tokens in environment variables and filesystem locations. On GitHub Actions runners, it attempts to obtain an OIDC token using the standard ACTIONS_ID_TOKEN_REQUEST_TOKEN and associated URL, leveraging the same mechanism legitimate workflows use for short-lived cloud credentials.

Package registries are another key data source. The script reads npm configuration files such as ~/.npmrc, scanning for bearer tokens and validating them against the npm registry’s whoami endpoint. It applies similar logic for Python’s PyPI (searching for tokens beginning with pypi-AgEIcHlwaS5vcmcCJ) and RubyGems (looking for rubygems_ tokens), giving the attackers potential access to a broad cross-ecosystem footprint.

The cloud credential harvesting is even more extensive. The malware probes AWS-related environment variables and config files, the EC2 instance metadata service, and ECS metadata endpoints, using sts:GetCallerIdentity calls to verify that any discovered credentials are valid before exfiltrating them. It repeats the pattern for Azure (client IDs, secrets, managed identities, and even Azure Key Vault) and for Google Cloud, checking service account JSON, metadata servers, and Secret Manager once it has a usable token.

Beyond cloud and package registries, the script trawls local disks for over 150 different glob patterns, including SSH private keys, Docker configs, .env files, Git credential stores, crypto wallet directories, messaging clients like Signal or Telegram Desktop, VPN configurations, and even configuration files linked to AI tools such as Claude. This breadth reflects an understanding of how TanStack Query–backed apps are typically developed and deployed: often in environments where a single machine or CI job has wide-ranging credentials for repositories, registries, and cloud providers.

Exfiltration through GitHub repos and worm-like propagation

Once data is collected, the malware takes an unusual approach to exfiltration. Rather than posting to a traditional command-and-control server, it uses GitHub repositories as public, encrypted drop boxes. This not only blends in with normal developer traffic, especially in TanStack Query–heavy organizations that already interact with GitHub constantly, but also makes takedown more complicated.

The script first searches GitHub’s public commit history for messages matching a very specific pattern that encodes an encrypted token inside the commit message text. It then decrypts that token to recover a GitHub credential, which it uses to create a new repository for each victim. This means that stolen data from one machine ends up stored under a completely different, already compromised account, further muddying attribution.

Each exfiltration repository is named by combining random Touhou Project character names with a numeric suffix (for example, cirno-marisa-74291), and its description is set to the malware’s own tagline, “Trinitite: Sponsored by Preview 2 Effects.” Within these repos, the script commits JSON files named like doubletrinnys-{counter}-{timestamp}.json inside a results/ folder.

The JSON layout is simple but carefully encrypted: it holds an envelope containing the bulk of the stolen credentials and a key field with the session key encrypted via the attacker’s public RSA key. This ensures that even though the files are technically public, only someone holding the corresponding private key can read the contents, leaving casual observers and most automated crawlers unable to see what was stolen.

In parallel, the malware acts as a worm. With valid npm, PyPI, or RubyGems tokens in hand, it enumerates every package owned by the compromised maintainer and publishes new, infected versions. The infection pattern follows the same scheme used in the original TanStack Query code generator compromise: injecting a malicious binding.gyp, dropping in 3FWCvzduYZg.js, and pushing the package using the stolen publish token. It also abuses stolen GitHub tokens to walk through accessible repositories, adding backdoored configuration files under .vscode, .claude, .github/workflows, and similar directories, all under innocuous commit messages like "chore: update dependencies".

This worm-like behavior dramatically amplifies the blast radius. A single organization using TanStack Query and @7nohe/openapi-react-query-codegen in its CI chain could inadvertently seed malware into dozens of internal packages and repositories if a compromised developer or build agent publishes new releases while infected.

Indicators of compromise for TanStack Query npm users

For teams that rely on TanStack Query and related npm tooling, some concrete indicators of compromise (IOCs) have been published to help identify exposure. The following versions of @7nohe/openapi-react-query-codegen were confirmed to contain the Trinitite payload and should be treated as untrusted:

• 0.5.4 and 0.5.5
• 1.6.3 and 1.6.4
• 2.2.1 and 2.2.2
• 3.0.3 and 3.0.4
• Prereleases 0.0.0-365d4eb738d3146583431948d3ba6e27a32556be and 0.0.0-ec7876d6c917dad516ba69bbfafc948b834bf0ab

Any appearance of a large, single-line JavaScript file named 3FWCvzduYZg.js in an npm package’s root directory is a strong red flag. Multiple SHA-256 hashes of that file have been documented, and administrators can compare them against archives of installed packages or cached tarballs in internal registries to spot known-bad copies.

On infected systems, temporary directories named with a trinnyyyy- prefix followed by six random alphanumeric characters in the OS temp folder may also indicate previous execution. These directories are used when downloading and staging the Bun runtime required by the inner payload.

Beyond the specific generator package, organizations should review npm audit data, internal package mirrors, and CI logs for unexpected binding.gyp files or sudden appearance of preinstall hooks in packages that did not previously rely on native addons or lifecycle scripts. In the context of TanStack Query, that typically means looking closely at any code-generation or OpenAPI integration tooling that plugs into React, Vue, or other frontends.

Finally, GitHub activity is worth scrutinizing. Repositories with descriptions matching “Trinitite: Sponsored by Preview 2 Effects”, or with results/doubletrinnys-*.json files and commit messages like "meow meow meow", should be investigated as potential exfiltration endpoints tied back to compromised TanStack Query npm usage.

What TanStack Query–heavy teams can do right now

For most organizations, the first step is to inventory where and how TanStack Query and its surrounding npm tooling are used. Because the compromised package generates hooks specifically for @tanstack/react-query, it tends to appear in projects with strong typing and automated OpenAPI client generation pipelines, often wired directly into CI.

Teams should verify whether any of the listed malicious versions of @7nohe/openapi-react-query-codegen were ever present in package-lock.json, pnpm-lock.yaml, or yarn.lock files, or pulled into dependency trees via transitive dependencies. Even if the package is no longer installed, historical use on build agents may warrant deeper investigation.

Where compromise is suspected, a parallel effort should focus on rotating tokens and credentials harvested by the malware. That includes GitHub personal access tokens, npm publish tokens, cloud access keys, and any long-lived secrets stored in environment variables or plaintext config files on CI runners. Cloud providers generally log sts:GetCallerIdentity and similar calls, which can help narrow the window of exposure.

Supply-chain security tools that specialize in malware scanning for npm packages can help surface infections that slipped past traditional vulnerability scanners. Some platforms already classify this campaign as a critical, 100/100 severity malware issue and provide nightly rescans or on-demand checks for repositories relying on TanStack Query and related dependencies.

Looking ahead, organizations that lean heavily on TanStack Query, @tanstack/react-query, or @tanstack/vue-query in production may want to strengthen guardrails around package installation. That can include proxy registries that block known-bad versions, tools that intercept commands like npm install or pnpm add and cross-check packages against threat intelligence feeds, and stricter use of provenance and signature verification—with the caveat that compromised CI pipelines can still produce “valid” attestations, as seen here.

As frontend stacks increasingly standardize on libraries like TanStack Query for data fetching and caching, attackers are likely to keep probing the surrounding ecosystem of generators, CLIs, and plugins published to npm. This incident underscores how a seemingly narrow utility package—one that simply emits TanStack Query hooks from an OpenAPI file—can become a high-impact entry point into build systems, monorepos, and cloud infrastructure when left unguarded.

The discovery of the Trinitite campaign against @7nohe/openapi-react-query-codegen highlights how popular npm packages tied to TanStack Query usage can quietly turn into supply-chain attack vectors when their release workflows are compromised. By abusing binding.gyp, obfuscated JavaScript loaders, and GitHub-based exfiltration, the attackers managed to hide a far-reaching credential stealer inside a tool many teams treated as routine plumbing. For organizations that rely on TanStack Query across React and other frontends, tightening npm hygiene, monitoring for suspicious lifecycle scripts, and hardening CI pipelines around OpenAPI and query-codegen tooling are no longer optional extras but part of the core risk model.