npm Supply Chain Worm Hits @7nohe/openapi-react-query-codegen
Date Observed: August 28, 2026Ecosystem: npm, with propagation capabilities targeting PyPI and RubyGemsTargets: Developers and CI runners installing @7nohe/openapi-react-query-codegen; maintainer, cloud, and CI/CD credentialsAttack Type: Self-propagating software supply chain worm (Shai-Hulud “Trinitite” variant); source package compromised via CI/CD workflow abuseImpact: Credential theft, cross-ecosystem propagation capability, and a destructive token-monitor trap Key Takeaways Introduction On August […]
What is Software Supply Chain Security?
Software supply chain security is the practice of protecting every component, tool, and process that goes into building and shipping software, from open-source packages and third-party libraries to the build systems that assemble them into a finished product. Modern applications are assembled far more than they’re written from scratch, and each borrowed piece carries the […]