A widely used npm package has become a credential-stealing delivery channel after attackers planted a self-spreading Shai-Hulud payload in its releases.

The affected @7nohe/openapi-react-query-codegen package, which generates TanStack Query code, receives more than 150,000 weekly downloads.

The malicious releases can run while a developer installs dependencies or when npm processes a specially crafted build configuration file.

That gives the malware an opening on workstations and automated build runners, where publishing, cloud, and source-code credentials are often available.

JFrog researchers identified the activity as a new Mini Shai-Hulud wave, dubbed Trinitite, that appeared on August 28. Ten releases were published in about 20 minutes, illustrating how quickly one trusted package compromise can reach downstream projects.

JFrog said in a report shared with Cyber Security News (CSN) that the incident matters because the worm steals tokens and tries to publish altered packages wherever the victim has permission.

That feedback loop turns one poisoned dependency into a wider supply-chain problem, similar to the earlier Shai-Hulud supply-chain attack and recent npm outbreaks across both individual and enterprise environments.

Popular npm Package

Attackers appear to have abused the project’s release workflow rather than npm itself. The analysis says any pull-request comment containing the exact release trigger could start a publishing job, which checked out the pull request and used GitHub Actions OpenID Connect, or OIDC, to obtain a trusted publishing token.

That missing maintainer check allowed a GitHub user to open pull requests, invoke the release process, and push packages with valid provenance.

Provenance confirms that a release job ran in the repository, but it does not establish that the released code was safe, an important distinction when reviewing dependency alerts.

Two initial prereleases contained a planted install component but not the complete worm. Eight later stable versions contained the payload.

Four relied on a weaponized binding.gyp file, while four later versions also added a preinstall hook, a technique covered in the binding.gyp supply-chain attack.

The loader is heavily disguised. It can download the Bun runtime if absent, decrypt the malware, run it from a temporary location, and remove that file afterward.

Crucially, skipping npm lifecycle scripts alone may not stop this case because node-gyp can process binding.gyp during installation. The package versions should be treated as a host compromise.

The report did not attribute the activity conclusively, though it noted the package appeared about a day after suspected TeamPCP members were arrested in Australia.

Credential Theft and Recovery Steps

Once active, Trinitite searches for credentials linked to GitHub, npm, PyPI, RubyGems, cloud services, HashiCorp Vault, and Kubernetes. It also targets CI secrets and data in AI development-tool locations.

The stolen material is encrypted and committed to public repositories using the victim’s GitHub token. The malware can use recovered publishing access to modify and republish packages. It also adds a workflow designed to collect repository secrets.

This combination affects developers and organizations whose build systems can publish software or hold deployment credentials, as shown in reporting on compromised workflow credentials theft.

Researchers also found persistence components for Linux and macOS, plus a token monitor that watches GitHub. If it detects that a token has been revoked, it can trigger a destructive cleanup routine.

That makes response order important: isolate the affected machine or runner before revoking credentials. Teams that installed an affected release should isolate the device or CI runner, stop and disable the identified user services, and remove the listed temporary and persistence files.

They should remove the dependency, pin known safe versions, rebuild lockfiles, and investigate repositories and release histories for unauthorized changes.

Only after the monitor is removed should defenders rotate GitHub, npm, PyPI, RubyGems, cloud, SSH, and CI credentials from a clean system.

Teams should also ensure untrusted pull-request comments cannot trigger publishing, and treat trusted provenance as a signal rather than proof of safety. Organizations can compare the propagation model with the new Mini Shai-Hulud campaign.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC