Full Report
On August 28, starting at approximately 2000 UTC eight malicious versions of the @7nohe/openapi-react-query-codegen package were published on npm and were available for approximately three hours. These malicious versions were trojanized with an updated version of the miasma ma...
Analysis Summary
# Incident Report: Supply Chain Compromise of @7nohe/openapi-react-query-codegen
## Executive Summary
Between 20:00 and 23:00 UTC on August 28, eight malicious versions of the npm package `@7nohe/openapi-react-query-codegen` were published following a supply chain compromise. The packages were trojanized with the "Miasma" malware, designed to exfiltrate sensitive credentials to GitHub and facilitate further automated spreading. The incident highlights the persistent risk of ecosystem-specific build systems (such as `binding.gyp`) being used to execute malicious payloads during package installation.
## Incident Details
- **Discovery Date:** August 28, 2026
- **Incident Date:** August 28, 2026
- **Affected Organization:** Users of `@7nohe/openapi-react-query-codegen`
- **Sector:** Software Development / DevOps
- **Geography:** Global (NPM Ecosystem)
## Timeline of Events
### Initial Access
- **Date/Time:** August 28, 2026, approx. 20:00 UTC
- **Vector:** Supply Chain Compromise
- **Details:** Attackers gained unauthorized access to the publisher's account or CI/CD pipeline to release eight trojanized versions of the package.
### Lateral Movement
- **Automated Spreading:** The Miasma malware contains functionality to automatically spread via multiple undisclosed channels to compromise additional systems and developer environments.
### Data Exfiltration/Impact
- **Credential Theft:** The malware gathered a wide range of local credentials from the infected environment.
- **Exfiltration:** Data was encrypted and posted to GitHub repositories using naming conventions themed around the "Touhou" video game series.
### Detection & Response
- **How it was discovered:** Security monitoring of the npm registry (Likely via Aikido/Wiz research).
- **Response actions taken:** The malicious versions were identified and removed from the npm registry after approximately three hours of availability.
## Attack Methodology
- **Initial Access:** Supply Chain Compromise (Malicious package version upload).
- **Persistence:** Not explicitly detailed, though automated spreading suggests an attempt to maintain a footprint across the ecosystem.
- **Privilege Escalation:** Not specified.
- **Defense Evasion:** Use of encryption for exfiltrated data and themed repository names on GitHub to blend in with legitimate traffic.
- **Credential Access:** Automated gathering of environment credentials.
- **Discovery:** System and credential reconnaissance.
- **Lateral Movement:** Automated propagation through multiple channels.
- **Collection:** Aggregation of sensitive developer/system credentials.
- **Exfiltration:** POSTing encrypted data to GitHub-hosted repositories.
- **Impact:** Supply chain contamination and data theft.
## Impact Assessment
- **Financial:** Unknown; potential costs associated with remediation and credential rotation for affected users.
- **Data Breach:** High risk; theft of developer credentials can lead to secondary breaches of private repositories and infrastructure.
- **Operational:** Minimal disruption to the package itself, but significant risk to the integrity of the software supply chain for users.
- **Reputational:** Damage to the package maintainer's trust and the perceived security of the npm ecosystem.
## Indicators of Compromise
- **Network indicators:**
- Outbound traffic to github[.]com (specifically to repositories with Touhou-themed names).
- **File indicators:**
- `@7nohe/openapi-react-query-codegen` (Versions published Aug 28, 20:00–23:00 UTC).
- Presence of `binding.gyp` files used for malicious script execution during install.
- **Behavioral indicators:**
- Unexpected encryption activity followed by HTTP POST requests to GitHub during `npm install` processes.
## Response Actions
- **Containment:** Malicious versions were removed from the npm registry.
- **Eradication:** Affected users are advised to delete `node_modules`, clear npm caches, and ensure they are using a known-good version (pre-August 28 or post-cleanup).
- **Recovery:** Rotation of all credentials (API keys, SSH keys, cloud tokens) that may have been present on the infected machines.
## Lessons Learned
- **Build System Vulnerability:** The `binding.gyp` and npm build lifecycle hooks remain primary targets for executing malware silently during installation.
- **Rapid Response:** The three-hour window of availability suggests improved detection capabilities, yet hundreds of downloads can occur in that timeframe.
- **GitHub as C2:** Attackers continue to use legitimate platforms like GitHub for exfiltration to bypass strict egress firewall rules.
## Recommendations
- **Lockfiles:** Always use `package-lock.json` or `yarn.lock` to prevent automatic updates to unverified versions.
- **Scoped Registries:** Use private proxies or scoped registries that require manual approval for new package versions.
- **Credential Hygiene:** Avoid storing plaintext secrets in environment variables or files that are accessible to the user running `npm install`.
- **Monitoring:** Implement runtime protection that monitors for unexpected network activity originating from package manager processes.