Loading story…
Attackers compromised TanStack’s npm release pipeline and published 84 malicious versions across 42 @tanstack/* packages, an incident tracked as CVE-2026-45321 with a CVSS score of 9.6. The intrusion chained a vulnerable GitHub Actions pull_request_target workflow, cache poisoning across the fork-to-base trust boundary, and theft of an OIDC token from runner memory, allowing the adversary to push malware under a trusted identity. The poisoned releases carried valid SLSA Build Level 3 provenance, showing that the builds originated from the legitimate pipeline even though that pipeline had been subverted.
The malicious packages used npm lifecycle execution and injected components including a fake @tanstack/setup dependency and a payload file named router_init.js to exfiltrate secrets from CI/CD systems and developer machines. Reporting tied the activity to the Shai-Hulud malware family and described a two-stage payload that harvested credentials, scraped GitHub Actions runner memory, exfiltrated data through multiple channels, and attempted self-propagation with stolen maintainer tokens; related package abuse was also noted in ecosystems including @opensearch-project/opensearch, @uipath/*, and @redhat-cloud-services. Defenders were urged to treat any affected installation as a likely credential compromise and to hunt for signs such as unusual publication bursts, tarball differences, unexpected github: dependencies pinned to commit SHAs, and files present in published tarballs but absent from package allowlists.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Analysis of the incident found the attackers abused a GitHub Actions pull_request_target workflow pattern, cache poisoning, and OIDC token theft from runner memory to publish signed malicious packages under a trusted identity. The malware used npm lifecycle hooks and a staged payload to exfiltrate secrets and attempt self-propagation to additional packages.
On 2026-05-11, attackers compromised 42 @tanstack/* npm packages and published 84 malicious versions within six minutes through TanStack’s legitimate CI/CD pipeline. The malicious releases carried valid SLSA Build Level 3 provenance despite containing malware.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
codeby.net
Open sourcezeropath.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
An attacker published **84 malicious npm artifacts across 42 `@tanstack/*` packages**, using TanStack’s legitimate GitHub Actions OIDC trusted-publisher path to push poisoned releases to the npm registry. TanStack said the intrusion chained a `pull_request_target` “Pwn Request” misconfiguration, GitHub Actions cache poisoning across the fork-to-base trust boundary, and runtime extraction of an OIDC token from the Actions runner process, allowing the attacker to publish under a trusted identity rather than altering the release workflow itself. Each impacted package received two malicious versions during a brief publication window, and the compromised releases were later deprecated and removed with help from npm security. The malicious packages installed an optional dependency that fetched attacker-controlled code and executed it through a `prepare` lifecycle hook, launching heavily obfuscated JavaScript designed to steal credentials from developer and CI environments. Reports say the payload searched for **AWS, GCP, Azure, Kubernetes, GitHub, SSH, and npm** secrets, including `.npmrc` contents, cloud credentials, GitHub tokens, and SSH keys, then exfiltrated the data over the encrypted Session/Oxen messenger network while masking activity behind an intentional install failure. TanStack purged GitHub Actions caches and hardened workflows, and users who installed affected versions were urged to treat affected hosts as compromised and rotate credentials immediately.
Jun 29, 2026
OpenAI said two employee devices were compromised after a malicious `@tanstack/*` npm package was installed during the broader **Mini Shai-Hulud** supply-chain campaign. The intrusion led to theft of a limited amount of internal credential material from repositories accessible to the affected employees, but the company said it found no evidence that customer data, production systems, deployed software, intellectual property, or production code were compromised or altered. OpenAI isolated the affected systems, revoked sessions, rotated credentials, restricted code-deployment workflows, and brought in a third-party incident response firm. The incident is tied to a wider attack on the npm ecosystem in which attackers allegedly abused TanStack’s GitHub Actions and CI/CD release pipeline to publish **84 malicious versions across 42 `@tanstack/*` packages**, stealing developer and cloud credentials. OpenAI is rotating signing certificates for several desktop products, including macOS apps, and warned users to update before June 12 because older certificates will be blocked from new notarizations. The campaign follows other identity-driven npm compromises, including the trojanized `axios` releases `1.14.1` and `0.30.4`, underscoring how stolen maintainer or publisher credentials can turn trusted software channels into malware delivery paths.
Jun 29, 2026
A large software supply-chain campaign dubbed **Mini Shai-Hulud** compromised more than 170 npm packages and at least two PyPI packages tied to projects including **TanStack, Mistral AI, OpenSearch, UiPath, Guardrails AI,** and others. Researchers and vendors attributed the activity to **TeamPCP**, saying the attackers abused GitHub Actions release workflows—especially `pull_request_target`, cache poisoning, and theft of short-lived **OIDC** material from runners—to publish trojanized packages with apparently legitimate **SLSA** provenance, Sigstore attestations, and trusted-publishing signatures. Reports variously counted between roughly 160 and 400+ malicious package versions, with some affected packages totaling hundreds of millions of downloads, and OpenSearch and Mistral both confirmed compromised releases while TanStack described a chained workflow attack on its publishing pipeline. The malware targeted developer workstations and CI/CD systems, stealing **npm**, **GitHub**, cloud, Kubernetes, Vault, SSH, Docker, and AI-tool credentials, then attempting worm-like propagation by republishing infected packages with stolen tokens or workflow-issued publish credentials. Investigators said the payload also established persistence through **VS Code** tasks, **Claude Code** hooks, and in some cases system services, while exfiltrating data through **Session**, GitHub dead drops, and other attacker infrastructure; some variants included extortion notes, dead-man-switch logic, and geofenced destructive behavior. Defenders were urged to treat hosts that installed affected versions as potentially fully compromised, remove persistence before revoking tokens where applicable, rotate all exposed secrets from clean systems, invalidate CI caches, audit lockfiles and publishing activity, and rebuild impacted environments from trusted sources.
Jul 12, 2026