Shai-Hulud Trinitite Worm Infects Popular TanStack Query npm Package to Steal Developer Secrets

Trinitite is a supply-chain worm that compromised the npm package @7nohe/openapi-react-query-codegen to steal a wide range of credentials and propagate by abusing GitHub Actions release workflows and npm publishing; the malware leverages a malicious binding.gyp evaluated by node-gyp (bypassing npm lifecycle-script inspection), an XOR-obfuscated loader, strong encryption, and persistence that can attempt destructive cleanup when tokens are revoked. Affected versions and IOCs are listed and the report urges isolating infected hosts/runners, removing persistence, regenerating lockfiles, pinning to safe releases, and rotating exposed credentials.