[Under Evaluation]: Multiple npm packages in the @7nohe/openapi-react-query-codegen* family appear compromised. Malicious releases contain an obfuscated binding.gyp that abuses node-gyp Python evaluation to reach os.system() and run node 3FWCvzduYZg.js (new ~5.8MB payload). Payload executes during install/build in dev/CI contexts. Treat affected @7nohe/openapi-react-query-codegen* packages as malicious; pin/rollback and block in registries.