Popular code generator for TanStack Query hit by supply chain worm

Trinitite is an active supply-chain malware campaign that injected malicious code into ten versions of the npm package @7nohe/openapi-react-query-codegen (high download volume). The attackers used a GitHub Actions workflow compromise and a Python sandbox escape in binding.gyp to execute an obfuscated JavaScript payload that harvests extensive credentials (cloud providers, developer tokens, keys, wallets and local files), exfiltrates data to public GitHub repositories as encrypted blobs, and self-propagates by publishing backdoored releases to npm/PyPI/RubyGems and committing backdoors to accessible GitHub repositories.