tanstack npm compromise: ci cache poisoning shipped 84 bad versions
Attackers chained a GitHub Actions workflow flaw, cache poisoning and an OIDC token pulled from runner memory to publish 84 malicious versions of TanStack Router and Start packages straight to npm; StepSecurity tied it to a wider self-spreading wave.
- affected
- 42 @tanstack/* packages, 84 versions (Router/Start repo only; Query, Table, Form and others not affected)
- look for
- router_init.js (~2.3 MB) in the package root; @tanstack/setup optionalDependency pointing at a github:tanstack/router commit
- exploited
- yes — malicious versions published to npm on 11 May 2026
- status
- TanStack declared all clear on 15 May 2026; all currently published versions are safe
what happened
- On 11 May 2026, attackers published 84 malicious versions across 42 @tanstack/* npm packages from the Router/Start repository, the first at 19:20:39 UTC.[1]
- The attack chained a pull_request_target 'Pwn Request' workflow, GitHub Actions cache poisoning, and extraction of an OIDC token from runner memory to publish directly to npm.[1]
- TanStack states that no npm tokens were stolen and that the npm publish workflow itself was not compromised.[1]
- An external researcher at StepSecurity opened a tracking issue at 19:46:46 UTC, and npm removed the affected tarballs between 22:13 and 23:55 UTC.[1]
- StepSecurity reported that the compromised packages carried valid SLSA Build Level 3 provenance attestations.[2]
- StepSecurity's list of compromised packages in the same wave includes packages under the @mistralai, @uipath and @opensearch-project npm scopes.[2]
- StepSecurity says the payload planted persistence in developer tools, including a Claude Code SessionStart hook and a VS Code task that runs when a folder opens.[2]
- TanStack's hardening included pinning third-party actions to SHAs, adding repository_owner guards and purging all GitHub Actions caches for its repos.[1]
sources2
- 01Postmortem: TanStack npm supply-chain compromise ↗ primaryTanStackaccessed 2026-10-21
- 02TeamPCP's Mini Shai-Hulud Is Back: A Self-Spreading Supply Chain Attack Compromises TanStack npm Packages ↗ secondaryStepSecurityaccessed 2026-10-21