Malicious code in @7nohe/openapi-react-query-codegen (npm)

The @7nohe/openapi-react-query-codegen npm package includes a binding.gyp file at the package root that exploits node-gyp's automatic rebuild during npm install to execute a shell command running an obfuscated JavaScript file (3FWCvzduYZg.js). This file is a large XOR-obfuscated payload acting as a loader/dropper, with no legitimate build source present in the package. The package.json declares only the 'dist' directory as files, but the malicious files are included at the root, bypassing the declared publish surface. The package's advertised functionality does not require native addons or large obfuscated code, confirming the malicious intent. Installation of this package results in arbitrary code execution on the host system.

Systems that install or run this package are fully compromised due to arbitrary code execution during installation. Attackers may gain full control over the affected system, potentially accessing all stored secrets and keys. Removal of the package alone does not guarantee eradication of all malicious artifacts or backdoors introduced by the payload.

Immediate removal of the @7nohe/openapi-react-query-codegen package is required. All secrets and keys stored on the compromised system should be rotated from a separate, trusted machine. Due to the high likelihood of full system compromise, a full forensic investigation and system rebuild may be necessary. No official patch or fix is available; avoid using this package entirely.