Trinitite worm hits npm TanStack Query codegen package

A self-spreading npm worm that researchers are calling Trinitite pushed poisoned builds of a popular TanStack Query code generator on 28 August. The package, @7nohe/openapi-react-query-codegen, is a community tool, not one of TanStack's own. The maintainer's GitHub security advisory rates the incident critical at CVSS 9.6 and carries no CVE.

The advisory says ten tainted versions were published through a compromised release workflow. Anyone who installed an affected version, "including transitively or in CI," ran "attacker-controlled code with the privileges of the installing process." The last clean stable build is 3.0.2.

The advisory lists eight tainted stable releases (0.5.4, 0.5.5, 1.6.3, 1.6.4, 2.2.1, 2.2.2, 3.0.3, 3.0.4) plus two 0.0.0 prereleases, all pushed on 28 August. The older 0.5.3, 1.6.2, and 2.2.0 are also safe. The maintainer traced the break to a misconfigured GitHub Actions workflow that let an unauthorized trigger cut releases, and has since moved publishing to a tag-push flow and written up the postmortem in issue 217. That closes the specific hole that was used. Packages already sitting in the registry are a separate problem.

Per JFrog's writeup, Trinitite is a new wave of the Shai-Hulud worm: it hunts credentials across GitHub, npm, PyPI, RubyGems, cloud providers, and Kubernetes, scrapes CI-runner memory for secrets, and republishes packages under stolen tokens to keep spreading. The advisory's impact line is the operative fact: install-time code execution wherever the package landed, transitive dependencies and CI jobs included. A lockfile bump alone does not close that out.

The target is different from the earlier Shai-Hulud wave that hit official @tanstack packages. There is no CVE. The record here is the repository advisory GHSA-9pvf-vcx3-x239. The global github.com/advisories mirror still returns 404, and any "CVE-2026" number circulating for this is not an identifier to track.

Attribution is open. JFrog declines to pin it on the crew behind earlier Shai-Hulud activity, writing that it "could be leftover access. Could be someone else wearing the cat mask. The payload does not settle that." JFrog puts the package in the "150K+ weekly download range," while OX Security's account counts 128,223 weekly downloads, and the labs' technical descriptions of the loader differ in places. Any single exposure figure is an estimate, not a headcount.

The advice that lines up across the advisory, JFrog, and Aikido is to quarantine any machine or runner that executed an affected version before rotating tokens, because this worm specifically watches for credential rotation. Pin to 3.0.2 (or 0.5.3, 1.6.2, 2.2.0), rebuild from a clean environment, then rotate GitHub, npm, and cloud secrets. The maintainer has shut the workflow hole, but attribution is unresolved and a live worm is still republishing under stolen tokens, the same supply-chain pattern as the recent poisoned Rust crates.

Some offers on this page may be paid placements or contain affiliate links.