TanStack & MANY more packages affected - a deep dive & analysis

Highlights

• A supply chain attack originating in the TanStack ecosystem on May 11, 2026, compromised packages including TanStack Query, Router, and Start within a 20-minute window.

• The malware functions as a worm, exfiltrating GitHub tokens, NPM tokens, and AWS credentials to a central command-and-control URL.

• Malicious code successfully migrated from the NPM ecosystem into the Python ecosystem via stolen credentials used to publish compromised versions of other libraries.

• The attack exploited a 'Pull Request Target' vulnerability in GitHub Actions to bypass trust boundaries and poison the CI/CD cache.

• Detection occurred because a malicious package was published even though the associated GitHub Actions workflow failed, creating a visible mismatch for contributors.

• Modern package managers like Bun, pnpm, and recent versions of npm can mitigate such risks by enforcing a minimum release age and blocking post-install scripts.

Timeline

1. 00:00 - 02:29

   Immediate Scope and Impact of the Supply Chain Attack

   The breach targets widespread developer tools like TanStack Query and Router, which are foundational to many modern web applications. Because the malware acts as a worm, it continuously seeks new credentials to further its reach across different language ecosystems. Users who installed or updated packages during the UTC window on May 11 must assume their local environments or CI/CD pipelines are fully compromised.

   • The attack began with the publication of malicious versions of all TanStack packages on May 11.
   • Compromised packages spread from NPM to the Python ecosystem within hours of the initial breach.
   • Malware identifies itself through outgoing network traffic to a specific exfiltration URL and unique file hashes in JavaScript files.
2. 02:29 - 04:37

   Mechanics of Data Exfiltration and Propagation

   The primary goal of the script is the harvesting of sensitive authentication data from typical storage locations like .env files or environment variables. Once a token is stolen, the malware uses it to impersonate the developer and inject malicious code into their own projects. This creates a recursive loop where one compromised dependency can lead to dozens of newly infected packages across GitHub and NPM.

   • Malware scans local systems and CI/CD environments for plaintext secrets, including AWS IAM credentials and GitHub tokens.
   • Stolen GitHub and NPM tokens allow the worm to automatically publish malicious updates to other repositories the victim maintains.
   • CI/CD workflows that depend on compromised packages act as unintentional vectors for spreading the malware to new targets.
3. 04:37 - 08:00

   Proactive Defense Strategies and Secure Configurations

   Security relies on moving away from local, plaintext secret storage in favor of cloud-based secret managers like InPhysical or Doppler. Using AWS Single Sign-On (SSO) instead of static IAM credentials further limits the utility of stolen data. Package managers like Bun offer native settings in bunfig.toml to ensure only vetted, older versions of packages are pulled during an install.

   • Developing inside virtual machines or dev containers prevents malware from accessing the root host system and its global secrets.
   • Configuring package managers to require a minimum release age prevents the immediate installation of 'zero-day' malicious versions.
   • Disabling post-install and lifecycle scripts in package managers blocks the most common execution path for supply chain malware.
4. 08:00 - 14:34

   Analysis of the Pull Request Target and Cache Poisoning Attack

   This elaborate pattern bypasses the standard isolation of forked repositories by exploiting how GitHub Actions handles shared resources. When an attacker opens a pull request, the hash_files command is manipulated to store a compromised dependency in the cache. When a maintainer later pushes code to the main branch, the CI/CD runner unknowingly restores the malicious cache, executing the worm's code within a high-trust environment.

   • The 'pull_request_target' trigger in GitHub Actions runs in the context of the base repository rather than the fork.
   • Attackers use malicious pull requests to write poisoned data into the shared GitHub Actions cache.
   • Subsequent legitimate runs by project maintainers pull the poisoned cache, effectively injecting the malware into the official build process.
5. 14:34 - 19:51

   Abuse of Trusted Publishing and Event Detection

   Even though Trusted Publishing is designed to be more secure than static tokens, the malware captures the token in memory the moment it is issued to the CI/CD runner. In this specific instance, the TanStack team caught the breach because the package was updated on NPM despite the GitHub Action reporting a failure. The increasing complexity of software dependencies and the availability of AI tools for finding vulnerabilities suggest a rising frequency of such automated attacks.

   • The malware intercepted short-lived OIDC tokens generated during NPM's Trusted Publishing process.
   • A failure in the legitimate build code caused a mismatch between the failed CI/CD status and the successful package publication.
   • AI-assisted analysis of source code and CI/CD configurations is making these elaborate supply chain attacks easier to execute.