Loading story…
Attackers abused trusted open-source distribution channels to publish malicious package updates, including 84 tainted TanStack releases uploaded within six minutes and a malicious payload discovered in the Guardrails-AI package on PyPI. The compromised packages were built to steal credentials from infected developer devices and move laterally to connected systems, highlighting how software supply-chain attacks can rapidly spread through widely used development dependencies.
OpenAI confirmed that employee devices were affected by the TanStack incident, giving attackers limited access to a small number of internal code repositories. The company said there was no evidence that customer data, production systems, intellectual property, or software releases were compromised, and it reported no persistent threat in operational infrastructure. Researchers detected the malicious activity in about 20 minutes, likely constraining the blast radius, while OpenAI rotated cryptographic certificates associated with the affected repositories as part of containment.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
Following the repository exposure, OpenAI rotated cryptographic certificates associated with the affected internal code repositories. This was part of its response to contain any potential downstream risk from the compromise.
OpenAI said compromised employee devices in the TanStack supply-chain incident gave attackers limited access to a small number of internal code repositories. The company stated that no customer data, production systems, intellectual property, or software releases were compromised, and it found no evidence of altered production software or persistent threats.
Researchers detected the malicious TanStack package activity within about twenty minutes of the uploads. This rapid identification likely limited the broader impact of the supply-chain attack.
In a six-minute window, attackers uploaded 84 malicious software updates tied to the TanStack supply-chain compromise. The packages were designed to steal credentials from infected devices and spread across connected systems.
Gurucul published threat research reporting the discovery of malicious payload delivery in the Guardrails-AI PyPI package. The reference indicates the discovery as a distinct supply-chain security event affecting a Python package ecosystem component.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
cysecurity.news
Open sourcecommunity.gurucul.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
OpenAI said two employee devices were compromised after a malicious `@tanstack/*` npm package was installed during the broader **Mini Shai-Hulud** supply-chain campaign. The intrusion led to theft of a limited amount of internal credential material from repositories accessible to the affected employees, but the company said it found no evidence that customer data, production systems, deployed software, intellectual property, or production code were compromised or altered. OpenAI isolated the affected systems, revoked sessions, rotated credentials, restricted code-deployment workflows, and brought in a third-party incident response firm. The incident is tied to a wider attack on the npm ecosystem in which attackers allegedly abused TanStack’s GitHub Actions and CI/CD release pipeline to publish **84 malicious versions across 42 `@tanstack/*` packages**, stealing developer and cloud credentials. OpenAI is rotating signing certificates for several desktop products, including macOS apps, and warned users to update before June 12 because older certificates will be blocked from new notarizations. The campaign follows other identity-driven npm compromises, including the trojanized `axios` releases `1.14.1` and `0.30.4`, underscoring how stolen maintainer or publisher credentials can turn trusted software channels into malware delivery paths.
Jun 29, 2026
Attackers compromised TanStack’s npm release pipeline and published 84 malicious versions across 42 `@tanstack/*` packages, an incident tracked as **CVE-2026-45321** with a CVSS score of 9.6. The intrusion chained a vulnerable GitHub Actions `pull_request_target` workflow, cache poisoning across the fork-to-base trust boundary, and theft of an OIDC token from runner memory, allowing the adversary to push malware under a trusted identity. The poisoned releases carried valid **SLSA Build Level 3** provenance, showing that the builds originated from the legitimate pipeline even though that pipeline had been subverted. The malicious packages used npm lifecycle execution and injected components including a fake `@tanstack/setup` dependency and a payload file named `router_init.js` to exfiltrate secrets from CI/CD systems and developer machines. Reporting tied the activity to the **Shai-Hulud** malware family and described a two-stage payload that harvested credentials, scraped GitHub Actions runner memory, exfiltrated data through multiple channels, and attempted self-propagation with stolen maintainer tokens; related package abuse was also noted in ecosystems including `@opensearch-project/opensearch`, `@uipath/*`, and `@redhat-cloud-services`. Defenders were urged to treat any affected installation as a likely credential compromise and to hunt for signs such as unusual publication bursts, tarball differences, unexpected `github:` dependencies pinned to commit SHAs, and files present in published tarballs but absent from package allowlists.
Jul 10, 2026
An attacker published **84 malicious npm artifacts across 42 `@tanstack/*` packages**, using TanStack’s legitimate GitHub Actions OIDC trusted-publisher path to push poisoned releases to the npm registry. TanStack said the intrusion chained a `pull_request_target` “Pwn Request” misconfiguration, GitHub Actions cache poisoning across the fork-to-base trust boundary, and runtime extraction of an OIDC token from the Actions runner process, allowing the attacker to publish under a trusted identity rather than altering the release workflow itself. Each impacted package received two malicious versions during a brief publication window, and the compromised releases were later deprecated and removed with help from npm security. The malicious packages installed an optional dependency that fetched attacker-controlled code and executed it through a `prepare` lifecycle hook, launching heavily obfuscated JavaScript designed to steal credentials from developer and CI environments. Reports say the payload searched for **AWS, GCP, Azure, Kubernetes, GitHub, SSH, and npm** secrets, including `.npmrc` contents, cloud credentials, GitHub tokens, and SSH keys, then exfiltrated the data over the encrypted Session/Oxen messenger network while masking activity behind an intentional install failure. TanStack purged GitHub Actions caches and hardened workflows, and users who installed affected versions were urged to treat affected hosts as compromised and rotate credentials immediately.
Jun 29, 2026