Skip to content
PERMISSION/PROTOCOL
Back to incident tracker

2026-08-28

HighPrimary

Compromised OpenAPI React Query Codegen Packages Stole Secrets and Tampered With AI Agent Configuration

Analysis of ten malicious OpenAPI React Query Codegen releases that stole cloud and CI credentials, modified AI-agent configuration, and carried valid npm provenance.

OpenAPI React Query CodegenCredential exposureCompromised release workflow and malicious npm install payloadDeveloper and CI environments installing affected @7nohe/openapi-react-query-codegen releases

What happened

The malicious package loader decrypted and executed a second-stage payload during installation, searched for credentials, altered AI-development-tool configuration, and attempted to propagate through other packages.

Why it matters

Potential theft of GitHub, cloud, registry, and CI credentials; unauthorized modification of Claude, Codex, Cursor, and MCP-related configuration; and further malicious package publication.

Missing authorization check

Independent authorization for release publication, credential access, and security-sensitive agent-configuration mutation rather than trusting workflow execution or package provenance alone.

Would PP block it?

A receipt-bound publish step could prevent a comment-triggered workflow from releasing an unapproved artifact, while runtime gates could deny unexpected secret reads and agent-configuration changes. Protection depends on keeping the gate and signing authority outside the compromised workflow and install process.

Incident analysis

Timeline and technical read

Timeline

  1. 2026-08-28

    A threat actor publishes ten malicious package versions in two waves through the compromised release workflow.

  2. 2026-08-28

    Socket publishes its technical analysis and identifies the latest release as compromised at the time of writing.

Technical breakdown

  • A comment-triggered GitHub Actions workflow exposed a path to the package publishing process.
  • The compromised workflow produced malicious releases with valid npm provenance, showing provenance attested who built the artifact rather than whether the workflow was authorized.
  • Install-time code decrypted and ran a second-stage payload targeting cloud, package-registry, GitHub Actions, and AI-agent configuration data.
  • Socket identified self-propagation behavior consistent with Mini Shai-Hulud and ten affected versions published on August 28.

Authorization boundary

Where the authorization boundary should have been

This incident is categorized as Credential exposure. The relevant Permission Protocol gate is Credential Gate. The read is conditional: the block only applies where the real action boundary is routed through a gate.

If enforced at
Package publication, credential-broker, and agent-configuration-write boundaries
Still needs
Dependency scanning, package removal, endpoint detection, credential rotation, and cleanup of compromised hosts remain separate controls.
Receipt required for
Publishing npm releases, retrieving deployment credentials, and modifying AI-agent or MCP configuration

Permission Protocol cannot make a compromised package safe, but Credential and Tool-Call Gates can withhold release authority, secrets, and configuration writes unless the exact action has independent approval.

Start small

Put the relevant gate at this action boundary.

This incident maps to Credential Gate. Start with the boundary that controls the actual action, then require a signed receipt before execution.

Replay this incident with a signer in the loop