npm: Malicious `@7nohe/openapi-react-query-codegen` Compromised in 40-Package Drop

Key findings

• 40 malicious npm packages disclosed within an 18-minute window on August 28, 2026
• High-profile package @7nohe/openapi-react-query-codegen (151k weekly downloads) was compromised
• Many packages impersonate internal or enterprise-specific libraries, suggesting targeted attacks
• The compromised @7nohe/openapi-react-query-codegen was first published over 4 years ago, indicating a potential maintainer takeover
• Affected systems should be considered fully compromised; all credentials must be rotated

On August 28, 2026, a critical vulnerability was disclosed in the npm package @7nohe/openapi-react-query-codegen (version = 0.5.4), a widely used library with approximately 151,000 weekly downloads. This disclosure was part of a rapid, coordinated takedown of 40 malicious npm packages, all reported within an 18-minute window between 22:59 UTC and 23:17 UTC. The package @7nohe/openapi-react-query-codegen, first published over four years ago in July 2022, suggests a potential maintainer takeover given its longevity and significant user base. The remaining 39 packages were also disclosed in this tight window, indicating a broad, synchronized attack.

While no single naming convention like a shared scope or prefix was immediately apparent across all 40 packages, a significant number of them appear to be impersonating internal or enterprise-specific libraries. Examples include analytics-web-client, confluence-create-content, jira-projects-backbone, amplitude-react-native, qbo-ui-services, and intuit-authz. Many of these packages were first published 5-6 months prior to their disclosure, suggesting they were either dormant accounts, previously benign packages that were later weaponized, or part of a long-term, targeted typosquatting effort against specific organizational environments or common enterprise software names.

Specific behavioral findings for these packages were not detailed in the advisories. However, the nature of such malicious packages often involves actions like credential exfiltration, remote code execution, or the establishment of persistent backdoors. Without explicit behavioral reports, users should assume a worst-case scenario for any affected systems that may have installed these packages.

The severity of the compromise, particularly for packages like @7nohe/openapi-react-query-codegen which was rated Critical, means that any system that installed the malicious version should be considered fully compromised. This type of attack can lead to complete system takeover, allowing attackers to steal sensitive data, inject further malware, or maintain persistent access. Users are advised to treat such incidents with the highest level of urgency.

Developers should immediately audit their package-lock.json or yarn.lock files for the presence of any of the 40 disclosed malicious packages. If any are found, the affected systems should be isolated, and all credentials (API keys, tokens, passwords) that may have been exposed on that system should be rotated from a separate, clean machine. Furthermore, it is crucial to review npm token logs for any unauthorized publish activity, especially if maintainer accounts were compromised. A representative list of some of the malicious packages includes:

• @7nohe/openapi-react-query-codegen
• sentrykit
• analytics-web-client
• confluence-create-content
• jira-projects-backbone
• amplitude-react-native
• intuit-authz

This burst highlights the ongoing threat of supply chain attacks targeting popular package ecosystems like npm. The coordinated nature of this disclosure, with 40 packages appearing within minutes, suggests a deliberate and organized effort by attackers. While the exact motivation and actor behind this specific campaign remain undisclosed, such incidents underscore the need for robust security practices, including dependency scanning, integrity checks, and vigilant monitoring of package registries.