Mini Shai-Hulud Strikes Again: openapi-react-query-codegen

Scenario A: Technical Threat, Vulnerability, or Exploit

A malicious package named openapi-react-query-codegen has been identified in the wild, following the same supply chain attack pattern as the previously reported "Mini Shai-Hulud" campaign. This is a real-time threat targeting developers who auto-generate API client code, likely exfiltrating credentials or injecting backdoors during the build process.

Technical Breakdown

• TTP (MITRE): T1195.001 (Supply Chain Compromise - Compromise Software Dependencies), T1059.006 (Execution - Python/Node.js build scripts)
• Behavior: Executes a malicious payload at install-time or during code generation, similar to the arrayref Rust crate attack referenced in the advisory.
• Affected Ecosystem: npm/PyPI (likely, given the codegen use case). Targets projects using OpenAPI specs with React Query.
• IOCs: None publicly disclosed yet. Monitor for unexpected outbound connections during npm install or pip install of this package.

Defense Block the package name openapi-react-query-codegen at the registry/proxy level immediately. Enforce runtime detection on build agents for unexpected process spawning or network calls during dependency installation.

Source: https://safedep.io/mini-shai-hulud-openapi-react-query-codegen-compromised