Critical Vulnerability in Popular npm Package Exposes Users to Supply Chain Attacks

Key Takeaways

• A popular npm package, @7nohe/openapi-react-query-codegen, with approximately 150,000 weekly downloads, has been compromised in a supply chain attack.
• Malicious versions, including 0.5.4, 1.6.3, 2.2.1, and 3.0.3, were published on August 28, 2023, containing hidden code designed for credential theft.
• The attack leverages an abuse of GitHub Actions trusted publishing, allowing malicious code from unverified pull requests to be published with a legitimate identity.
• The payload, identified as a Mini Shai-Hulud variant, actively seeks and exfiltrates credentials from development environments, cloud services, and continuous integration (CI) systems.
• Organizations must treat installations of affected versions as host compromises and implement comprehensive containment, remediation, and credential rotation measures.

A significant supply chain compromise has impacted a widely used JavaScript development package, exposing potentially hundreds of thousands of developers and automated build systems to malicious code execution. The incident involves a tool boasting roughly 150,000 weekly downloads, raising serious concerns about the integrity of the software supply chain.

On August 28, 2023, attackers released ten compromised versions of the package in two distinct waves. These malicious releases targeted every actively maintained version line, transforming what would typically be a routine dependency update into a critical entry point for credential theft and further system compromise.

The malicious code executes during the package installation process. This is achieved through a combination of build configuration manipulation and, in some releases, the use of a pre-install command. This technique bypasses standard security checks that often focus solely on lifecycle scripts.

Socket.dev said in a report, which was shared with Cyber Security News (CSN), that the hidden program activated during installation is designed to scour files, processes, cloud services, and continuous integration environments for sensitive credentials. Analysts at Socket.dev have linked this activity to an ongoing Mini Shai-Hulud compromise, which has the capability to reuse stolen access and modify build environments, potentially escalating a single installation into a widespread supply chain issue.

Compromise Details and Execution Path

The affected package, @7nohe/openapi-react-query-codegen, is designed to generate code for connecting applications with APIs. A critical aspect of this attack is that the malicious releases carried valid npm provenance records. This means that the proof of an approved workflow building a package did not expose the embedded malicious code, complicating detection efforts.

Researchers discovered that the compromised versions were signed via GitHub Actions trusted publishing. The vulnerability stemmed from a workflow that could be triggered by a comment on a pull request. This workflow would then check out code directly from that pull request’s fork and publish it using the repository’s trusted identity. Crucially, the workflow failed to verify that the commenter was a legitimate, trusted contributor to the repository. While provenance confirms which automated workflow generated an artifact, it does not inherently guarantee the safety of the underlying source code.

This incident underscores the necessity for development teams to rigorously review and strengthen safeguards around publishing jobs, particularly any workflows that respond to external comments while possessing permissions to publish packages or acquire identity tokens. The execution path of the malicious code mirrors techniques observed in previous supply chain incidents, such as the binding.gyp compromise. In this case, the implanted program, an obfuscated JavaScript file (3FWCvzduYZg.js), was concealed and launched via the native-build path, activated by the binding.gyp build configuration.

Credential Theft and Broader Impact

Upon activation, the payload initiates an aggressive search for access tokens and other secrets across various components of the development environment. This includes project files, process memory, cloud metadata services, and CI variables. The malware then attempts to validate the stolen credentials, encrypts the results, and stores them in public GitHub repositories created by the attackers. This method of exfiltration can simultaneously expose access to code-hosting platforms, package registries, cloud environments, and various developer tools.

Beyond credential theft, the malware exhibits further malicious capabilities. It can modify GitHub Actions workflows, monitor tokens on macOS and Linux systems, and inject background commands into AI coding-assistant settings. The threat actor can leverage reachable SSH hosts for lateral movement and propagate poisoned packages within writable registry scopes. This behavior bears resemblance to the credential-driven propagation seen in earlier Shai-Hulud supply chain attacks, though this overlap alone does not conclusively attribute the current incident to the same operators.

What You Should Do

• Isolate and Preserve: Immediately isolate any machine or runner that installed an affected release. Preserve all forensic evidence for incident response.
• Neutralize Persistence: Identify and neutralize any persistence mechanisms established by the malware.
• Revoke and Rotate Credentials: After neutralizing persistence, revoke and rotate all potentially exposed credentials, including package, GitHub, cloud, CI, and developer tool access tokens. Be aware that the malware may react if a stored GitHub token returns an error, so timing is crucial.
• Rebuild Environments: Where feasible, rebuild affected environments from a known-clean image.
• Inspect Lockfiles and SBOMs: Review lockfiles and software bills of materials (SBOMs) to identify direct and indirect usage of the compromised package.
• Clear Caches and Reinstall: Clear all relevant caches and reinstall dependencies from a clean lockfile that is pinned to a known-good, uncompromised release.
• Review Activity Logs: Security teams should meticulously review logs for suspicious repository creation, workflow changes, deployment activity, unexpected dependency-update commits, and any unusual artifacts.
• Strengthen CI/CD Security: Treat CI runners with the same incident-response urgency as employee endpoints. Implement mandatory trusted-contributor checks before any comment-triggered workflow can publish code.
• Limit Token Privileges: Implement the principle of least privilege for all tokens and API keys used in automated workflows to reduce the blast radius in case of compromise.

This incident reinforces the critical lesson from previous compromises, such as the Keyv npm package compromise: dependency trust cannot be based solely on a registry signature or provenance record. Robust security practices, including careful review of release triggers, strict dependency locking, and granular token privilege management, are essential to mitigate the impact of abused trusted publishing paths.

Indicators of Compromise (IoCs)

For a detailed list of Indicators of Compromise, including malicious package versions, threat actor GitHub accounts, malicious files, and persistence artifacts, please refer to the comprehensive report: Popular npm Package With 150K Weekly Downloads Compromised in Mini Shai-Hulud Supply Chain Attack.

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.