Hackers Compromise TanStack Query npm Package to Steal Developer Credentials

A supply-chain worm has compromised multiple releases of @7nohe/openapi-react-query-codegen, an npm package that generates type-safe TanStack Query hooks.

Aikido Security said it identified 10 malicious versions published within 20 minutes. Because the package records more than 150,000 weekly downloads, the incident poses exposure risk to development teams.

The breach exposes developer workstations and CI systems to credential theft, repository backdoors, and secondary package poisoning, transforming a routine JavaScript dependency installation into a potentially enterprise-wide compromise event across environments.

Hackers Compromise TanStack Query npm Package

Researchers dubbed the payload “Trinitite: Sponsored by Preview 2 Effects” and said its tradecraft resembles TeamPCP-linked activity, although attribution remains unresolved.

The compromise affected npm and the project’s GitHub repository. Attackers are believed to have exploited a weakness in a GitHub Actions workflow, allowing malicious releases to retain provenance attestations.

That distinction matters: provenance demonstrates an artifact originated from an approved workflow, but cannot establish that the workflow was unmodified or trustworthy.

Most weaponized versions used binding.gyp, a Node.js native-addon build configuration file. During installation, node-gyp evaluates conditions through Python.

The malicious configuration abuses Python’s class hierarchy to locate catch_warnings, recover built-in functions, import os, and execute an obfuscated Node.js payload. No native build occurs; the file functions as an installation-time execution trigger.

Some prerelease builds relied on explicit preinstall scripts, while later versions combined both techniques. The payload, 3FWCvzduYZg.js, is a 5.4 MB single-line file protected by XOR, AES-GCM, and JavaScript obfuscation.

It silently downloads the Bun runtime before launching credential-harvesting routines, complicating review and turning dependency installation into the execution stage.

The malware checks for Russian locale settings, directories, scanner decoy credentials, research accounts, and StepSecurity’s harden-runner, exiting when it detects analysis conditions.

It targets tokens for GitHub, npm, PyPI, and RubyGems, as well as AWS, Azure, Google Cloud, and HashiCorp Vault credentials. Kubernetes, SSH, Git, VPN, and Claude AI files are sought. Aikido said the malware can query cloud metadata services and validate cloud credentials before exfiltration.

Collected information is encrypted, then committed to GitHub repositories named after Touhou Project characters and labeled with the Trinitite description. This use of repositories gives operators a collection endpoint blending credential theft with infrastructure.

The worm can reuse publishing tokens to inject files into packages on npm, PyPI, and RubyGems. GitHub tokens may enable repository poisoning through backdoored VS Code tasks, Claude Code hooks, fake CodeQL workflows, or configuration files for developer tools.

Such propagation turns one compromised environment into mechanism infecting projects and ecosystems. Organizations should identify installations of releases, revoke and rotate credentials on systems that ran npm install, and inspect repositories for commits or files.

Teams should review GitHub Actions workflows, pin dependencies, and restrict publishing tokens. Provenance is valuable, but it is an assurance layer, not proof that a build pipeline remains uncompromised.

IOCs

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM. 

Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC