Supply‑Chain Worm Infects Popular TanStack Query Code Generator on npm

Aikido Security has uncovered a supply‑chain attack that infiltrated ten consecutive releases of the npm package @7nohe/openapi‑react‑query‑codegen, a tool used to automatically create type‑safe TanStack Query hooks for React applications.

The malicious code was published over a span of just 20 minutes, allowing the worm to spread quickly across the package’s distribution channel. By embedding credential‑stealing payloads, the compromised versions could harvest authentication tokens and other sensitive data from developers who installed the package.

@7nohe/openapi‑react‑query‑codegen is widely adopted in the JavaScript community because it streamlines the integration of OpenAPI specifications with TanStack Query, a popular data‑fetching library. Its popularity means that the breach potentially exposed a large number of projects, especially those that rely on automated code generation to maintain type safety.

The incident follows a series of high‑profile npm supply‑chain compromises, such as the event‑stream and colors packages, underscoring the persistent risk of third‑party dependencies. Security researchers note that attackers often target packages with frequent updates and a broad user base, leveraging the trust developers place in the npm ecosystem.

After detecting the malicious versions, Aikido Security alerted the package maintainer, who promptly removed the compromised releases and issued a warning to users. The security firm also provided remediation steps, advising developers to audit their lockfiles, rotate any credentials that may have been exposed, and consider enabling two‑factor authentication on npm accounts.

Experts suggest that the episode highlights the need for stronger supply‑chain defenses, including automated provenance checks, reproducible builds, and stricter publishing controls on registry platforms. As the open‑source community continues to grapple with these threats, both maintainers and consumers are urged to adopt best‑practice security hygiene to mitigate future attacks.