PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Popular code generator for TanStack Query hit by supply chain worm

aikido.dev | incident | #supply-chain | #threat-intelligence | #malware | #github-actions | #npm | #javascript-security | #aikido | #binding-gyp | #tanstack
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Aikido: ten versions of @7nohe/openapi-react-query-codegen (150k weekly downloads) were poisoned in 20 minutes; the worm exploits a GitHub Actions flaw and node-gyp's Python evaluation of binding.gyp.

Why it matters

This incident coverage highlights active npm package poisoning and practical supply chain defensive lessons.
Published
Collected

Related coverage

incident · wiz.io
M-Red-Team: AsyncAPI Supply Chain Compromise via GitHub Actions
Four @asyncapi npm packages (5 versions) shipped after an attacker exploited a 'pwn request' in an asyncapi/generator GitHub Actions workflow to steal a bot token; the payload runs on import.
incident · wiz.io
s1ngularity: supply chain attack leaks secrets on GitHub: everything you need to know
Wiz's initial analysis of s1ngularity: malicious Nx npm versions harvested wallets, tokens and SSH keys and abused local AI CLIs for recon; a second phase exposed 5,500+ private repositories.
Critical · vulnerability · aikido.dev
Node2Shell Evolves to HTTP2Shell: Google Brotli Flaw (CVE-2026-111497) Affects HTTP Ecosystem
Brotli is ubiquitous across the modern HTTP ecosystem for web asset compression. Because the flaw allows unauthenticated remote code execution in both directions, any service or client automatically decompressing untrusted Brotli payloads is at critical risk until patched.
blog · aikido.dev
LiteLLM compromised again: infostealer and RAT found in version 1.107.0
# LiteLLM compromised again: infostealer and RAT found in version 1.107.0 Written by Ilyas Makari Published on: Oct 21, 2026 On October 21, 2026, version 1.107.0 of LiteLLM (a popular open source...
blog · aikido.dev
tensorlake NPM package compromised with Shai Hulud worm
# tensorlake NPM package compromised with Shai Hulud worm Written by Oliver Smith Published on: Oct 8, 2026 On 8 October 2026 a threat actor published a compromised version of tensorlake to npm....
research · aikido.dev
Novel supplychain.local Go worm appears
On 23 September 2026, a threat actor published a novel supply chain worm to the following packages:
Back