
Research
/Security News
OpenAPI React Query Codegen Compromised in Mini Shai-Hulud npm Supply Chain Attack
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.
@7nohe/openapi-react-query-codegen
Advanced tools
Affected versions:
Code generator for TanStack Query (React Query) based on your OpenAPI schema —
queryOptionsfactories following the official TanStack Query v5 pattern, plus ready-to-use hooks, prefetch, ensure, suspense, and infinite query helpers.
📖 Documentation · Migrating to v3
queryOptions / infiniteQueryOptions factories for every GET operation — the TanStack Query v5 recommended pattern, composable with useQuery, useQueries, useSuspenseQuery, prefetchQuery, ensureQueryData, and setQueryData with full type safetyuseQuery, useSuspenseQuery, useMutation, useInfiniteQuery, and useSuspenseInfiniteQuery variants per operationprefetchQuery, prefetchInfiniteQuery, and ensureQueryData functions per operation — ready for Next.js App Router hydrationnpm install -D @7nohe/openapi-react-query-codegen
npx openapi-rq -i ./petstore.yaml
import { useQuery } from "@tanstack/react-query";
import { findPetsOptions } from "./openapi/queries";
function Pets() {
const { data } = useQuery(findPetsOptions({ query: { limit: 10 } }));
// ...or use the generated hook directly: useFindPets({ query: { limit: 10 } })
}
See the documentation for CLI options, SSR recipes, and infinite query usage.
| This library | @hey-api tanstack-query plugin | Orval | |
|---|---|---|---|
queryOptions / infiniteQueryOptions factories (TanStack v5 pattern) | ✅ | ✅ | ❌ |
Ready-to-use hooks (useQuery / suspense / infinite variants) | ✅ | ❌ (options only) | ✅ |
SSR helpers (prefetchQuery / prefetchInfiniteQuery / ensureQueryData) | ✅ | ❌ | Partial (usePrefetch) |
| Hierarchical query keys for granular invalidation | ✅ | ✅ (tags) | Partial |
| Stable release line | ✅ SemVer | pre-1.0, frequent breaking changes | ✅ |
| MSW mock generation | ❌ (out of scope) | ❌ | ✅ |
| Vue / Solid / Svelte / Angular | ❌ React-focused | ✅ | ✅ |
Scope: this library is deliberately React-focused and does not generate API mocks — use Orval if MSW mocks are your priority, or hey-api's own plugin if you need non-React frameworks.
This library builds on @hey-api/openapi-ts, which is pre-1.0 and moves fast. We pin the exact hey-api version and absorb its breaking changes for you: hey-api upgrades land here only after our full snapshot-test suite passes, and are released as minor versions. Your generated API surface follows SemVer — breaking output changes only happen in major versions, with a migration guide.
@tanstack/react-query 5.x (peer dependency)typescript 5.x or 6.x, ts-morph 28.x, commander 12–15 (peer dependencies)MIT
FAQs
OpenAPI React Query Codegen
The npm package @7nohe/openapi-react-query-codegen receives a total of 110,892 weekly downloads. As such, @7nohe/openapi-react-query-codegen popularity was classified as popular.
We found that @7nohe/openapi-react-query-codegen demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Research
/Security News
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.

Security News
Socket joins more than 100 technology, cybersecurity, and financial organizations calling for a global surge in cyber defense.

Product
Enterprise security teams can now detect malware, credential theft, suspicious network activity, and risky updates across Microsoft Edge extensions.