Response to a credential-stealing npm package

The evidence recorded through 2026-09-01 describes a credential-stealing npm package and explicitly supports immediate inventory.

If @7nohe/openapi-react-query-codegen executed in a development or build environment, developer and cloud credentials accessible there may require rotation. Waiting for exact affected versions would delay the investigation even though package presence and execution can be checked now.

Developers whose workstations or development environments contain @7nohe/openapi-react-query-codegen may have developer credentials exposed if it executed.

Continuous-integration and build-runner operators must determine whether the package ran where cloud credentials or active sessions were accessible. Cloud account owners must rotate potentially exposed credentials and invalidate affected sessions when execution is confirmed.

Because affected versions are absent, maintainers cannot yet limit this investigation to named releases.

1. Public incident summary — support: its excerpt states, “Malicious npm package steals developer and cloud credentials.” 2. Evidence review of the recorded interaction and incident material — support: it identifies a credential-stealing npm package and explicitly recommends immediate inventory followed by credential rotation when malicious execution is confirmed. 3. Recorded npm retrieval — context only: its excerpt names @7nohe/openapi-react-query-codegen and reports search results, but supplies no affected versions, hashes, or substantive containment findings. 4. Quarantine review — insufficient evidence: repository and runner quarantine language was traced to a separate Composer campaign. 5. Release-blocking review — evidence gap: precise blocking cannot be implemented without affected npm versions or hashes.

The decision scout proposed inventorying @7nohe/openapi-react-query-codegen, quarantining repositories and runners, blocking malicious releases, and rotating credentials after confirmed execution.

The evidence auditors supported immediate inventory and conditional credential rotation but found two limits: quarantine evidence came from a separate Composer campaign, and no affected npm versions or hashes were available for precise blocking. The boundary reviewer endorsed that narrower scope.

The linker found no prior Decision Record to update, and the arbiter selected a new record limited to inventory, investigation, and rotation after confirmed execution.