Malicious TanStack npm packages stole cloud credentials via abused GitHub Actions trust

An attacker published 84 malicious npm artifacts across 42 @tanstack/* packages, using TanStack’s legitimate GitHub Actions OIDC trusted-publisher path to push poisoned releases to the npm registry. TanStack said the intrusion chained a pull_request_target “Pwn Request” misconfiguration, GitHub Actions cache poisoning across the fork-to-base trust boundary, and runtime extraction of an OIDC token from the Actions runner process, allowing the attacker to publish under a trusted identity rather than altering the release workflow itself. Each impacted package received two malicious versions during a brief publication window, and the compromised releases were later deprecated and removed with help from npm security.

The malicious packages installed an optional dependency that fetched attacker-controlled code and executed it through a prepare lifecycle hook, launching heavily obfuscated JavaScript designed to steal credentials from developer and CI environments. Reports say the payload searched for AWS, GCP, Azure, Kubernetes, GitHub, SSH, and npm secrets, including .npmrc contents, cloud credentials, GitHub tokens, and SSH keys, then exfiltrated the data over the encrypted Session/Oxen messenger network while masking activity behind an intentional install failure. TanStack purged GitHub Actions caches and hardened workflows, and users who installed affected versions were urged to treat affected hosts as compromised and rotate credentials immediately.