Critical Vulnerability in npm Package ‘netmask’ Exposes Credentials

Key Takeaways

• A critical supply chain attack, dubbed “Trinitite,” has compromised the popular npm package @7nohe/openapi-react-query-codegen, which boasts over 150,000 weekly downloads.
• Attackers exploited a vulnerability in the package’s GitHub release workflow, allowing them to publish malicious versions containing a self-spreading credential-stealing worm.
• The malware targets a broad range of credentials, including those for GitHub, npm, PyPI, cloud services, and CI/CD environments, and can propagate by republishing compromised packages.
• Users of affected versions (0.5.4, 0.5.5, 1.6.3, 1.6.4, 2.2.1, 2.2.2, 3.0.3, 3.0.4) are urged to immediately isolate affected systems, revoke credentials, and update to safe versions.

A widely-used npm package, @7nohe/openapi-react-query-codegen, has been weaponized by attackers to distribute a sophisticated credential-stealing worm. This package, responsible for generating TanStack Query code, is downloaded more than 150,000 times weekly, making the incident a significant supply chain threat.

The malicious code is designed to execute during dependency installation or when npm processes specific build configuration files. This provides the malware an entry point into developer workstations and automated build environments, where sensitive credentials for publishing, cloud platforms, and source code repositories are frequently accessible.

The Trinitite Campaign

Researchers at JFrog identified this activity as a new iteration of the Mini Shai-Hulud worm, which they named “Trinitite.” The campaign commenced on August 28, with ten compromised releases appearing within approximately 20 minutes. This rapid deployment underscores how quickly a single compromised trusted package can infect numerous downstream projects, as JFrog said in a report.

According to JFrog’s findings, the worm’s impact is compounded by its ability to steal authentication tokens and then leverage those permissions to publish altered packages. This creates a dangerous feedback loop, transforming an initial compromise into a broader supply-chain attack, reminiscent of previous Shai-Hulud incidents and other npm ecosystem breaches affecting both individual developers and enterprise systems.

Exploiting the Release Workflow

The attackers did not directly compromise npm infrastructure. Instead, they exploited a flaw in the project’s GitHub release workflow. The vulnerability allowed any pull-request comment containing a specific release trigger to initiate a publishing job. This job would then check out the pull request and utilize GitHub Actions OpenID Connect (OIDC) to acquire a valid publishing token. The absence of a maintainer review step meant a GitHub user could submit pull requests, trigger the release process, and push packages with seemingly legitimate provenance.

While provenance confirms that a release job was executed within the repository, it does not guarantee the safety of the released code. This distinction is crucial for organizations evaluating the trustworthiness of their dependencies.

Initial malicious prereleases contained a partial install component, but the full worm payload was included in eight subsequent stable versions. Four of these versions leveraged a weaponized binding.gyp file, a technique previously observed in other supply chain attacks. Four later versions further incorporated a preinstall hook, enhancing their ability to execute during installation.

The malware’s loader employs obfuscation techniques, capable of downloading the Bun runtime if it’s not present, decrypting the main payload, executing it from a temporary location, and then deleting the temporary file. A critical aspect of this attack is that merely skipping npm lifecycle scripts may not prevent execution, as node-gyp can process the malicious binding.gyp during installation. Consequently, any affected package versions should be considered indicative of a host compromise.

While the report did not definitively attribute the attack, researchers noted that the package appeared roughly a day after suspected members of TeamPCP were apprehended in Australia.

Credential Theft and Recovery Steps

Once activated, Trinitite systematically scans for credentials related to GitHub, npm, PyPI, RubyGems, various cloud services, HashiCorp Vault, and Kubernetes. It also targets Continuous Integration (CI) secrets and data within Artificial Intelligence (AI) development tool directories. The stolen information is then encrypted and committed to public repositories using the victim’s compromised GitHub token. The malware can exploit this recovered publishing access to modify and republish packages, and it also injects a workflow designed to harvest additional repository secrets.

This attack model poses a severe risk to developers and organizations, especially those whose build systems have permissions to publish software or manage deployment credentials.

Researchers also discovered persistence mechanisms for both Linux and macOS environments, alongside a token monitor that tracks GitHub tokens. If a token is detected as revoked, the malware can trigger a destructive cleanup routine. This highlights the critical importance of incident response order: affected machines or CI runners must be isolated *before* any credentials are revoked.

What You Should Do

• Immediately isolate any device or CI runner that has installed or interacted with the compromised package @7nohe/openapi-react-query-codegen, particularly versions 0.5.4, 0.5.5, 1.6.3, 1.6.4, 2.2.1, 2.2.2, 3.0.3, or 3.0.4.
• Stop and disable any identified user services linked to the compromise and remove temporary and persistence files (e.g., /tmp/trinnyyyy-*/bun, /var/tmp/.shit, ~/.bun/bin/bun, ~/.local/share/diaper/poopy.py, ~/.config/systemd/user/systemd-detect-fash.service, ~/Library/LaunchAgents/com.user.systemd-detect-fash.plist).
• Remove the compromised dependency from all projects. Pin all dependencies to known safe versions (e.g., 0.5.3, 1.6.2, 2.2.0, 3.0.2) and rebuild lockfiles to ensure only trusted versions are used.
• Thoroughly investigate repositories and release histories for any unauthorized changes or newly added workflows.
• From a clean, uncompromised system, rotate all GitHub, npm, PyPI, RubyGems, cloud, SSH, and CI/CD credentials.
• Review and harden GitHub Actions or similar CI/CD workflows to prevent untrusted pull-request comments from triggering publishing processes. Treat trusted provenance as an indicator, not absolute proof of code safety.

Indicators of Compromise (IoCs):

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.