diff --git a/threat_intel/README.md b/threat_intel/README.md
index 9f702dd..0d2daa2 100644
--- a/threat_intel/README.md
+++ b/threat_intel/README.md
@@ -12,6 +12,7 @@ the entries against current advisories before production use.
 
 | File | Campaign | Source |
 |---|---|---|
+| [`openapi-react-query-codegen-2026-08-28.json`](openapi-react-query-codegen-2026-08-28.json) | Mini Shai-Hulud npm supply-chain compromise of `@7nohe/openapi-react-query-codegen` (10 malicious versions published 2026-08-28 across every maintained release line via a comment-triggered GitHub Actions publishing workflow; obfuscated `binding.gyp`/`preinstall` loader targets cloud, npm, GitHub Actions, and AI agent secrets with self-propagation) | [Socket, 2026-08-28](https://socket.dev/blog/openapi-react-query-codegen-npm-compromise) |
 | [`mastra-2026-06-17.json`](mastra-2026-06-17.json) | Mastra npm supply-chain compromise (141 packages / 141 versions across `@mastra/*` plus `create-mastra` and the `easy-day-js@1.11.22` typosquat dependency that delivered a cross-platform infostealer via postinstall) | [Socket, 2026-06-17](https://socket.dev/blog/mastra-npm-packages-compromised) |
 | [`mini-shai-hulud-leoplatform-2026-06-24.json`](mini-shai-hulud-leoplatform-2026-06-24.json) | Mini Shai-Hulud / Miasma (Hades variant) LeoPlatform/RStreams wave (compromised `czirker` npm account; 26 npm packages + 1 Go module / 27 versions; "Phantom Gyp" `binding.gyp` install hook, Bun-staged infostealer, "Alright Lets See If This Works" dead-drop marker) | [Socket, 2026-06-24](https://socket.dev/blog/miasma-mini-shai-hulud-hits-leoplatform-npm-packages-go-ecosystem); [OX Security, 2026-06-24](https://www.ox.security/blog/alright-lets-see-if-this-works-shai-hulud-miasma-hades-variant-spreads-on-npm/) |
 | [`mini-shai-hulud.json`](mini-shai-hulud.json) | Mini/Shai-Hulud May 2026 npm and PyPI compromise (OX Security affected-package table) | Cross-checked against Fleet, Socket, Snyk, Mistral, TanStack, The Hacker News |
@@ -63,4 +64,4 @@ and no enumerated `affected[].versions` are skipped. Output is
 deterministic, validates against the schema, and should be reviewed
 before use. The generated `_comment` records scope, per-ecosystem
 counts, skip-reason breakdown, and the optional `-source` provenance
-label.
+label.
\ No newline at end of file
diff --git a/threat_intel/openapi-react-query-codegen-2026-08-28.json b/threat_intel/openapi-react-query-codegen-2026-08-28.json
new file mode 100644
index 0000000..e4d9f55
--- /dev/null
+++ b/threat_intel/openapi-react-query-codegen-2026-08-28.json
@@ -0,0 +1,26 @@
+{
+  "schema_version": "0.2.0",
+  "_comment": "Mini Shai-Hulud npm supply-chain compromise of @7nohe/openapi-react-query-codegen, reported by Socket on 2026-08-28 (https://socket.dev/blog/openapi-react-query-codegen-npm-compromise). Ten malicious versions were published in two waves ~20 minutes apart on 2026-08-28, spanning every maintained release line (last known-good per line: 0.5.3, 1.6.2, 2.2.0, 3.0.2). Malicious releases execute an obfuscated bundled loader (3FWCvzduYZg.js) at install time via a node-gyp binding.gyp hook; wave-2 manifests additionally add a preinstall script for the same loader. The second-stage payload targets cloud credentials, package-registry credentials, GitHub Actions secrets, and AI agent configuration, and contains self-propagation functionality. All ten versions carry valid npm provenance attestations issued via a comment-triggered GitHub Actions publishing workflow that gated only on comment text, allowing any account to publish a fork's code under the repo's trusted-publishing identity. Corroborated by npm registry publication timestamps (2026-08-28T20:00Z-20:20Z) and deps.dev; OSV and the GitHub Advisory Database had not yet published entries at the time of cataloging.",
+  "entries": [
+    {
+      "id": "socket-2026-08-28-mini-shai-hulud-npm-7nohe-openapi-react-query-codegen",
+      "name": "@7nohe/openapi-react-query-codegen (Mini Shai-Hulud August 2026 compromise)",
+      "ecosystem": "npm",
+      "package": "@7nohe/openapi-react-query-codegen",
+      "versions": [
+        "0.0.0-365d4eb738d3146583431948d3ba6e27a32556be",
+        "0.0.0-ec7876d6c917dad516ba69bbfafc948b834bf0ab",
+        "0.5.4",
+        "0.5.5",
+        "1.6.3",
+        "1.6.4",
+        "2.2.1",
+        "2.2.2",
+        "3.0.3",
+        "3.0.4"
+      ],
+      "severity": "critical",
+      "source": "https://socket.dev/blog/openapi-react-query-codegen-npm-compromise"
+    }
+  ]
+}
\ No newline at end of file