Poisoned Pipeline / Incidents / AS20
@7nohe/openapi-react-query-codegen poisoned publish workflow
On 28 August 2026 an external GitHub user posted the comment "npm publish"
on a pull request. The project's release workflow trusted that comment from
any PR participant, checked out the untrusted PR, installed its
dependencies, and published to npm with GitHub Actions OIDC (Trusted
Publishing). Ten malicious versions shipped; install hooks and a malicious
binding.gyp ran attacker code, downloaded Bun, and harvested GitHub
credentials. StepSecurity reproduced the behavior under Harden-Runner.
Charlie Eriksen reported the releases in GitHub issue #217.
Mapped techniques
- T0147 Scan public CI/CD configurations for secrets and vulnerable actions
- T0202 Inadequate CI/CD workflow permissions
- T0166 Trigger pipeline execution
- T0183 Harvesting short-lived token
- T0109 Publish malicious artifact
- T0151 Installation scripts
- T0140 Harvest tokens from environment variables
- T0159 Malicious artifact execution
supply-chain GitHub Actions release workflow
The issue_comment workflow that published on a literal "npm publish"
comment was public and required no maintainer role check.
id-token: write plus checkout of untrusted PR head let any commenter
mint a Trusted Publisher identity.
The attacker opened PRs #215/#216 and posted the trigger comment;
the workflow ran and published.
npm Trusted Publishing used a short-lived OIDC token instead of a
stored npm password — still enough to publish.
Ten versions, including 3.0.4 mapped as npm latest, were published.
post-supply-chain Installers of the package
preinstall ran node 3FWCvzduYZg.js; binding.gyp decoded to the same
command via os.system when node-gyp evaluated it.
Direct payload execution ran gh auth token and git credential-manager
and probed GCP metadata.
Installing an affected version was enough; npm latest still pointed
at 3.0.4 at the time of the write-up.
Framework gaps noted
- Comment-to-publish workflows are a recurring 2026 pattern still modeled as T0202 plus T0166.
Sources
- https://www.stepsecurity.io/blog/7nohe-openapi-react-query-codegen-compromised-npm-publishing-workflow
- https://github.com/7nohe/openapi-react-query-codegen/issues/217
- https://safedep.io/mini-shai-hulud-openapi-react-query-codegen-compromised
- https://www.reversinglabs.com/blog/npm-bindinggyp-cicd-secrets
- https://www.aikido.dev/blog/popular-code-generator-for-tanstack-query-hit-by-supply-chain-worm
- https://socket.dev/blog/openapi-react-query-codegen-npm-compromise
- https://www.stepsecurity.io/blog/binding-gyp-npm-supply-chain-attack-spreads-like-worm