OpenAPI React Query Codegen Compromised in Mini Shai-Hulud npm Supply Chain Attack

A sophisticated supply chain attack leveraged a comment-triggered GitHub Actions workflow to publish ten malicious, credential-stealing versions of @7nohe/openapi-react-query-codegen to npm—all with valid provenance—enabling widespread compromise of developer, CI, and cloud environments.