---
id: 6759
title: "Popular code generator for TanStack Query hit by supply chain worm"
source_domain: aikido.dev
source_url: "https://www.aikido.dev/blog/popular-code-generator-for-tanstack-query-hit-by-supply-chain-worm"
published_at: "2026-08-28T00:00:00Z"
tags: ["supply-chain", "threat-intelligence", "malware", "github-actions", "npm", "javascript-security", "aikido", "binding-gyp", "tanstack"]
phying_url: "https://phying.com/item/6759"
lang: en
---

# Popular code generator for TanStack Query hit by supply chain worm

## Summary

Aikido: ten versions of @7nohe/openapi-react-query-codegen (150k weekly downloads) were poisoned in 20 minutes; the worm exploits a GitHub Actions flaw and node-gyp's Python evaluation of binding.gyp.

## Why it matters

This incident coverage highlights active npm package poisoning and practical supply chain defensive lessons.

## Intelligence Metadata

- **Sources:** aikido.dev
- **Published:** 2026-08-28T00:00:00Z
- **Original:** https://www.aikido.dev/blog/popular-code-generator-for-tanstack-query-hit-by-supply-chain-worm
- **Phying News:** https://phying.com/item/6759