Mini Shai-Hulud toolkit hits npm: @7nohe/openapi-react-query-codegen trojanized via GitHub Actions issue_comment flaw
On August 28, 2026, an attacker published 10 malicious versions of the npm package @7nohe/openapi-react-query-codegen (about 671K downloads/month) without stealing any credentials. They abused the repository's GitHub Actions release.yml workflow, which had an issuecomment trigger with no author-association gate. Commenting npm publish on …