TanStack npm supply-chain compromise (Mini Shai-Hulud): hijacked release pipeline pushed credential-stealing malware into 42 @tanstack packages

Who is affected

This isn’t a bug in TanStack’s code. Attackers took control of TanStack’s release pipeline and put malware into npm packages under TanStack’s name. The people actually put at risk are the ones who installed the malicious versions.

About versions: TanStack’s advisory says each package got exactly two malicious versions (for example @tanstack/react-router 1.169.5 and 1.169.8), which fits the 84 versions / 42 packages count. The GitHub Advisory Database lists the same 84 versions individually, so the two agree. The table lists each package’s two malicious versions and first safe version (the @tanstack/ prefix is omitted):

Exposure window: TanStack says the malicious versions were detected 20 to 26 minutes after going live. All 84 were deprecated by 21:03 UTC, and npm removed the tarballs between 22:13 and 23:55 UTC. Download counts for the malicious versions are unconfirmed.

How it works

TanStack’s postmortem describes three weaknesses in its GitHub Actions setup that the attacker chained together:

1. “Pwn Request.” A workflow triggered by pull_request_target ran code from an outside fork’s pull request with the main repository’s privileges, and first-time contributors needed no approval. The attacker also renamed their fork so it wouldn’t show up in the fork list.
2. Cache poisoning. That run could write to the GitHub Actions cache (the pnpm package store). The main repository’s later release workflow reused the poisoned cache.
3. OIDC token theft. During the real release run, the poisoned code read the runner’s memory, pulled out a short-lived OIDC token allowed to publish to npm, and published the malicious versions directly, going around the normal publish step. TanStack says no npm tokens were stolen and the publish workflow itself was not modified.

Because the packages really did come out of TanStack’s pipeline, they carried valid SLSA Build Level 3 provenance and Sigstore signatures. As StepSecurity points out, provenance proves which pipeline built something, not that the pipeline behaved as intended.

The flawed approach (conceptual illustration, not TanStack’s actual configuration):

# Runs with main-repository privileges, but executes code from an outside PR
on: pull_request_target
steps:
  - checkout: the outside PR's code
  - run: install dependencies and run them (can write to the shared cache)
# The release workflow later reads the same cache and holds npm publish rights

The fixed approach:

# Outside PRs use the pull_request trigger: no secrets, read-only
on: pull_request
permissions: read-all
# Release workflow: protected branches only, no cache, actions pinned to commit SHAs,
# and only this job can obtain the OIDC token used to publish to npm

What the malware did: Through an optionalDependencies entry and an install lifecycle script, the malicious versions ran router_init.js, about 2.3 MB of obfuscated JavaScript, automatically during npm install. TanStack confirms it stole AWS credentials (instance metadata and Secrets Manager), GCP metadata, Kubernetes service-account tokens, Vault tokens, ~/.npmrc, GitHub tokens and SSH keys; sent them out over the Session/Oxen messenger network; and used the victim’s access to republish other packages they maintain.

The following come from research firms (StepSecurity, Wiz, Snyk, CSA) and are not described in TanStack’s postmortem:

• A SessionStart hook in Claude Code’s .claude/settings.json and a folder-open task in VS Code’s .vscode/tasks.json, so the payload runs again whenever the tool opens, plus a gh-token-monitor background service.
• A “dead-man’s switch” that deletes the home directory when the stolen token is revoked. TanStack’s follow-up post confirms the switch existed, but sources differ on the trigger: Wiz says a daemon checks GitHub every 60 seconds for revocation; StepSecurity describes npm tokens created with a description warning that revoking them would wipe the owner’s computer.
• Wiz also reports that the malware stops on Russian-language systems, and that the gh-token-monitor background process exits on its own 24 hours after it starts (only that background process stops; this does not mean the infection or the stolen credentials stop being a problem).
• Researchers also report GitHub commits authored as claude@users.noreply.github.com, meant to blend in with AI-agent commits.

Timeline

Further reading

• Scoring: the CVSS 3.1 score of 9.6 comes from GitHub (the CNA); NVD lists it as a “Secondary” score, and no separate NVD score was found. “User interaction required” reflects that the victim has to install the package.
• CWE differences: GitHub, the CVE record and NVD all say CWE-506 (Embedded Malicious Code); the CISA KEV entry has an empty CWE list and calls it an “Unspecified Vulnerability.”
• Ransomware flag: KEV marks ransomware use as “Known.” Snyk says TeamPCP has a documented partnership with the Vect ransomware group, CSA says the group has cryptocurrency-theft and ransomware roots, and SecurityWeek mentions no ransomware link. The KEV entry does not say why it was flagged, so CISA’s basis is unconfirmed, and this page does not claim ransomware was deployed through this incident.
• The wider campaign: the name “Mini Shai-Hulud” and the attribution to TeamPCP come from StepSecurity, Wiz, Snyk and CSA; TanStack’s postmortem names no campaign. Researchers report that the same day also hit about 65 UiPath npm packages, Mistral AI (npm and PyPI mistralai@2.4.6), guardrails-ai@0.10.1, the OpenSearch JS client and Squawk packages, with an earlier wave against SAP packages in late April. Counts differ: CSA gives 373 malicious entries across 169 npm and 2 PyPI packages; SecurityWeek at least 401 artifacts across 170+ packages in five hours; Snyk about 170 packages. CVE-2026-45321 covers only the 42 TanStack packages; whether every other victim was infected via TanStack is unconfirmed.
• The AI developer tooling angle: the persistence hid in Claude Code and VS Code config folders, which are often git-ignored and rarely reviewed, and the fake “claude” commit author was used to blend in with AI-agent commits.
• Added to KEV in the same batch: CISA’s 2026-05-27 notice added three entries at once: Daemon Tools Lite (CVE-2026-8398), TanStack (this page) and the Nx Console VS Code extension (CVE-2026-48027). All three are cases of malicious code shipped in official releases.
• Where the Shai-Hulud name comes from: in September 2025 the first npm worm called “Shai-Hulud” stole developers’ credentials and used the stolen npm access to publish malware into the victims’ other packages; CISA issued an alert at the time saying more than 500 packages were compromised. The 2026 “Mini Shai-Hulud” waves (SAP packages in late April, TanStack on this page) reuse the same self-spreading technique. Researchers attribute them to TeamPCP; whether they are the same actors as in 2025 is unconfirmed.
• Related weakness type: CWE-506; GitHub Actions pull_request_target risks and cache poisoning.