Trinitite Worm Infects Popular npm Package, Stealing Developer Credentials
A supply-chain attack has compromised the @7nohe/openapi-react-query-codegen npm package, injecting a credential-stealing worm dubbed Trinitite that targets developer workstations and build systems.
A widely-used npm package, @7nohe/openapi-react-query-codegen, which is downloaded over 150,000 times weekly, has been compromised by attackers who injected a self-spreading, credential-stealing worm named Trinitite. This malicious code was inserted into several releases of the package, posing a significant risk to developers and organizations relying on it for code generation.
The worm can execute during the dependency installation process or when npm processes a specially crafted build configuration file. This allows it to gain access to developer workstations and automated build runners, where sensitive credentials for cloud services, source code repositories, and publishing platforms are often stored. JFrog researchers identified this as a new wave of the Mini Shai-Hulud campaign, with ten malicious releases published in rapid succession on August 28, highlighting the speed at which such supply-chain compromises can propagate.
Attackers appear to have exploited the package's release workflow, rather than a direct vulnerability in npm itself. By leveraging pull-request comments, they could trigger a publishing job that used GitHub Actions OpenID Connect (OIDC) to obtain trusted publishing tokens. This mechanism, combined with a lack of rigorous maintainer checks, allowed unauthorized users to push malicious code with seemingly valid provenance, creating a deceptive sense of security.
Multiple versions of the package were affected, with eight stable releases containing the full worm payload. Some versions utilized a weaponized binding.gyp file, while later ones also incorporated a preinstall hook, a technique previously seen in other supply-chain attacks. The malware employs a sophisticated, XOR-wrapped loader that can download the Bun runtime if necessary, decrypt the payload, execute it from a temporary location, and then erase its tracks, making detection more challenging.
Once active, the Trinitite worm actively searches for and exfiltrates credentials related to GitHub, npm, PyPI, RubyGems, various cloud providers, HashiCorp Vault, and Kubernetes. It also targets CI secrets and data within AI development tool environments. The stolen information is encrypted and committed to public repositories using the victim's compromised GitHub token, and the malware can even use recovered publishing access to modify and republish other packages, further amplifying the supply-chain risk.
The worm also establishes persistence mechanisms on Linux and macOS systems and includes a token monitor that watches for revoked GitHub tokens, triggering a destructive cleanup routine if detected. This behavior underscores the importance of a specific response order: isolating affected systems before revoking credentials. Developers and security teams are advised to isolate compromised machines, disable suspicious services, remove malicious files, and carefully rotate credentials from a clean environment after ensuring the malware's persistence components are eradicated.
This incident serves as a stark reminder of the ongoing threats within the software supply chain. The ability of the Trinitite worm to steal credentials, publish altered packages, and establish persistence highlights the sophisticated tactics employed by threat actors. Organizations must treat trusted provenance as a signal, not absolute proof of safety, and implement robust checks throughout their development and deployment pipelines to mitigate such risks.