Shai-Hulud Trinitite Hits @7nohe/openapi-react-query-codegen

Reported 31 Aug 2026 by otx · Severity: medium

A new Mini Shai-Hulud worm variant named Trinitite was detected on August 28, 2026, targeting the npm package @7nohe/openapi-react-query-codegen, a TanStack Query codegen tool with over 150K weekly downloads. The attacker exploited a workflow vulnerability that allowed any GitHub