TanStack npm Supply-Chain Attack Published Signed Malware via GitHub Actions

Attackers compromised TanStack’s npm release pipeline and published 84 malicious versions across 42 @tanstack/* packages, an incident tracked as CVE-2026-45321 with a CVSS score of 9.6. The intrusion chained a vulnerable GitHub Actions pull_request_target workflow, cache poisoning across the fork-to-base trust boundary, and theft of an OIDC token from runner memory, allowing the adversary to push malware under a trusted identity. The poisoned releases carried valid SLSA Build Level 3 provenance, showing that the builds originated from the legitimate pipeline even though that pipeline had been subverted.

The malicious packages used npm lifecycle execution and injected components including a fake @tanstack/setup dependency and a payload file named router_init.js to exfiltrate secrets from CI/CD systems and developer machines. Reporting tied the activity to the Shai-Hulud malware family and described a two-stage payload that harvested credentials, scraped GitHub Actions runner memory, exfiltrated data through multiple channels, and attempted self-propagation with stolen maintainer tokens; related package abuse was also noted in ecosystems including @opensearch-project/opensearch, @uipath/*, and @redhat-cloud-services. Defenders were urged to treat any affected installation as a likely credential compromise and to hunt for signs such as unusual publication bursts, tarball differences, unexpected github: dependencies pinned to commit SHAs, and files present in published tarballs but absent from package allowlists.