Shai-Hulud Is Back — A Trusted npm Package Turned Into a Credential-Stealing Worm
- The Mess: A new Shai-Hulud supply-chain wave, dubbed Trinitite, compromised the popular npm package
@7nohe/openapi-react-query-codegenand pushed malicious releases to developers and CI environments. - The Damage: The worm steals developer, cloud, source-control and package-registry credentials — then uses whatever access it finds to spread through additional software packages.
- The Fix: Remove the malicious versions immediately, isolate potentially affected machines or CI runners, and rotate credentials only after the infected environment has been contained and cleaned.
The package was legitimate.
The provenance was legitimate.
The malware was not.
A new variant of the Shai-Hulud supply-chain worm, tracked as Trinitite, compromised @7nohe/openapi-react-query-codegen, a popular code generator for TanStack Query with roughly 150,000 weekly downloads.
And this is the part developers should pay attention to:
the poisoned releases carried valid provenance.
The Release Pipeline Did the Attackers’ Work
The attackers reportedly abused the project’s release workflow rather than breaking npm itself.
A pull request could trigger a publishing workflow through a specific comment.
The workflow then checked out code from the pull request and used the repository’s trusted GitHub Actions OIDC publishing identity to release packages.
Result:
attacker-controlled code received a trusted publishing path.
The packages could therefore look legitimate to systems checking provenance.
Because technically, the release workflow really did publish them.
It just published malware.
Ten Versions Went Bad
Researchers identified malicious releases published on August 28.
Affected versions included:
0.5.40.5.51.6.31.6.42.2.12.2.23.0.33.0.4
Researchers also identified malicious prereleases associated with the campaign. The poisoned versions were published rapidly, giving downstream projects very little time to notice what had happened.
One trusted dependency became a delivery mechanism.
That’s the whole nightmare of modern supply-chain security.
The Worm Wants Your Entire Developer Environment
Trinitite isn’t interested in one password.
The malware targets credentials and tokens associated with:
- GitHub
- npm and other package registries
- cloud platforms
- CI/CD systems
- Kubernetes
- Vault
- source-control environments
- developer workstations
The objective is simple.
Steal access. Find more places to publish malware. Repeat.
That’s what makes Shai-Hulud particularly nasty.
A normal infostealer compromises a developer.
A supply-chain worm tries to turn that developer into the next distribution point.
Installation Can Be Enough
The malicious package contains an obfuscated multi-stage payload designed to execute during installation or build-related processing.
That means the victim doesn’t necessarily need to manually run a suspicious binary.
They install or process a dependency.
The dependency handles the rest.
This is exactly why software supply-chain attacks remain so dangerous.
Developers are trained to distrust random executables.
They’re trained to install packages.
The Malware Learned New Tricks
Researchers found changes compared with earlier Mini Shai-Hulud variants.
The Trinitite wave used updated obfuscation and altered indicators, while continuing the same general model of stealing credentials and exfiltrating data through attacker-controlled infrastructure.
Researchers also observed infected GitHub repositories containing stolen information linked to the campaign.
The worm changes.
The objective doesn’t.
Get credentials.
Get publishing rights.
Poison another package.
CI/CD Is Part of the Blast Radius
A compromised developer laptop is bad.
A compromised CI runner can be worse.
Build environments often have access to:
- package publishing tokens
- cloud credentials
- deployment secrets
- source repositories
- signing infrastructure
Exactly the things a self-propagating supply-chain worm wants.
One malicious npm dependency inside the wrong pipeline can become a problem for every project that pipeline publishes.
That’s how a package compromise turns into an ecosystem compromise.
Don’t Rotate Everything Immediately
There is an important incident-response detail here.
If a potentially infected system is still under attacker control, immediately rotating credentials can simply give the malware new secrets to steal.
Researchers recommend isolating and cleaning affected systems first, then rotating potentially exposed credentials from a known-clean environment.
That rotation should include developer, GitHub, npm, cloud, SSH and CI/CD credentials where relevant.
Changing passwords while the thief is still watching the keyboard is not containment.
It’s just providing an updated password.
What Developers Should Check
Teams using @7nohe/openapi-react-query-codegen should immediately review dependency lockfiles and build history.
Check whether any affected versions were installed.
Review:
- developer machines
- CI runners
- cached npm dependencies
- GitHub tokens
- npm publishing credentials
- cloud credentials
- recent package releases
- unusual GitHub repository activity
If an affected version executed, treat the environment as potentially compromised.
Because this malware wasn’t designed to politely steal one token and leave.
It was designed to multiply.
Bugstoday Opinion
This attack delivers a particularly ugly lesson.
Valid provenance does not mean safe code.
The publishing pipeline can be trusted.
The identity can be trusted.
The package can still be malicious.
Because the attacker didn’t necessarily need to break the trust mechanism.
They found a way to make the trusted mechanism publish their code.
That’s worse than another stolen npm token.
It means developers can do everything they were told to do — install from the official registry, verify provenance, use the legitimate package name — and still end up running malware.
Bugstoday verdict: supply-chain security has a trust problem. Shai-Hulud didn’t need to disguise itself as an untrusted package. It found a way to ride the trusted release pipeline instead.
Today’s Bugs. Tomorrow’s Breaches.
