A new cybersecurity incident involving a supply-chain attack has been identified, named Trinitite. This attack has successfully compromised the npm package known as @7nohe/openapi-react-query-codegen, a popular TanStack Query code-generation library that routinely garners over 150,000 downloads each week. The implications of this breach could significantly impact developers and organizations relying on this library for their applications.
The malicious releases orchestrated in this attack deploy an evolved variant of the Mini Shai-Hulud worm. This piece of malware is particularly concerning as it is intended to extract sensitive information including credentials for development tools, cloud services, CI/CD environments, package registries, Kubernetes, Vault, and even source-control systems. The stolen access credentials can be leveraged to infiltrate additional packages, further extending the scope of this attack.
Despite sharing operational patterns and propagation behavior with previous cyber incidents—such as the notable “Here We Go Again,” May 19 @antv, and Miasma waves—the specifics of the current payload do not neatly correspond to any single identified actor. Enhanced strategies including release-chain abuse, fresh RSA encryption keys, new campaign identifiers, and a cleverly concealed execution path using a binding.gyp file mark this incident as both sophisticated and troubling.
The compromise was initiated through a flawed configuration in the GitHub Actions release workflow. Alarmingly, the project had set up its system to treat a specific comment on pull requests containing the phrase “npm publish” as an authorization signal to publish a release. This vulnerability was exploited when an account dubbed p00paboot opened several malicious pull requests, thereby triggering the publication of harmful versions of the package without proper validation from repository maintainers.
Critically, this incident demonstrates the limitations of provenance tracking—while it may confirm where an artifact was built, it does nothing to assure users that the code executed within that trusted release environment is free of malicious intent. Initially, attackers launched two prereleases, the first being 0.0.0-365d4eb…, which included a suspicious preinstall command that sought to install a program called Bun and execute a non-existent file named is_it_this_simple.js. While this first version did not carry the ultimate payload, its environment variables betrayed the malicious intent and target packages.
In addition, eight stable releases, identified as versions 0.5.4, 0.5.5, 1.6.3, 1.6.4, 2.2.1, 2.2.2, 3.0.3, and 3.0.4, contained the actual worm. A significant technical alteration was the inclusion of a malicious binding.gyp file. This file was pivotal as the first series of stable versions relied solely on it, while subsequent releases added a more conventional preinstall script that called another obfuscated JavaScript file: 3FWCvzduYZg.js.
According to JFrog Security Research, the campaign was detected on August 28, 2026, shortly following the arrests in Australia of individuals linked to a group known as TeamPCP. This loader file, which ranges from 4 MB to 6 MB and is XOR-obfuscated, remains a significant threat even when npm install –ignore-scripts is executed to bypass the preinstall hook. This is because malicious actions can still be performed when node-gyp evaluates the binding.gyp file.
Intriguingly, attackers embedded the command to activate the worm within Unicode-escaped Python code contained in a conditional statement. Once decoded, this command would invoke Python built-ins to execute the malicious node script. Security mechanisms that focus exclusively on examining package.json lifecycle scripts may miss this manipulative execution chain since node-gyp processes the conditions through Python.
Once Trinitite is activated, it specifically targets credentials related to widely used platforms and services, including GitHub, npm, PyPI, RubyGems, Vault tokens, Kubernetes material, SSH keys, Docker credentials, and CI/CD secrets. Remarkably, it can even scrape values marked as sensitive from memory, thereby capturing identity material that is never stored on disk.
The compromised data is compressed, encrypted, RSA-wrapped, and subsequently committed to public GitHub repositories controlled by the attackers. Moreover, the worm has built-in logic to re-publish affected packages, thereby perpetuating the cycle of infection. In GitHub Actions environments, stolen OpenID Connect (OIDC) materials can be exchanged for npm publishing credentials, transforming Shai-Hulud into a propagating package worm rather than merely a credential stealer.
Trinitite incorporates a damaging token-revocation feature, which poses a severe risk for organizations using it. The worm can enable persistent installations that may attempt to wipe users’ home directories and documents if certain GitHub tokens become invalid.
For organizations that may have installed affected versions, immediate isolation of the developer workstations or CI runners is pivotal. After terminating and removing persistence mechanisms, it is equally important to revoke any compromised credentials. Security teams are advised to carry out thorough inspections of installations and building artifacts for any suspicious files associated with this attack and to take proactive measures, such as regenerating lockfiles from trusted sources.
In summation, the Trinitite attack illustrates a deeply concerning evolution in cyber threats, with supply-chain vulnerabilities being a prominent avenue for exploitation. With the potential for widespread impact, it is critical for developers and organizations to remain vigilant and proactive in safeguarding their environments.