Active npm supply chain compromise of @7nohe/openapi-react-query-codegen (~150,000 weekly downloads), linked to the ongoing Mini Shai-Hulud campaign. An unprotected GitHub Actions release workflow let any account publish fork contents under the repository's trusted-publishing identity, producing ten malicious versions across the 0.5.x, 1.6.x, 2.2.x and 3.0.x lines that harvest developer and cloud credentials and poison downstream packages.