Threats Tagged 'node-gyp'

An attacker exploited a flawed GitHub Actions workflow in the npm package @7nohe/openapi-react-query-codegen to publish 10 malicious versions. The vulnerability stemmed from an issue_comment trigger lacking author-association checks, allowing arbitrary users to trigger npm publishing from forked repositories. The malicious payload used multiple execution methods, including a binding.gyp file exploiting node-gyp's Python evaluation and a preinstall hook, ultimately delivering a large obfuscated script that downloaded Bun v1.4.0. This attack aligns with the Mini Shai-Hulud toolkit previously seen in other supply chain compromises. All malicious versions have been removed from npm.