git-tanstack[.]com

A new wave of the Mini Shai-Hulud campaign compromised dozens of TanStack npm packages as part of a broader supply chain attack affecting developer ecosystems, including packages tied to UiPath, Mistral AI, OpenSearch and PyPI. In April, Mini Shai‑Hulud initially targeted SAP‑related packages before culminating into its largest wave in mid‑May, where attackers have hijacked legitimate release pipelines to publish hundreds of malicious package versions. According to new analysis by Socket, 84 npm package artifacts in the TanStack namespace were modified with suspected credential-stealing malware targeting continuous integration systems, including GitHub Actions. At least one affected package, @tanstack/react-router, receives more than 12 million weekly downloads, Socket claimed. How the TanStack Compromise Worked TanStack said the attacker published 84 malicious versions across 42 @tanstack/* packages on May 11, 2026, between 19:20 and 19:26 UTC. The project said the attack chained the pull_request_target "Pwn Request" pattern, GitHub Actions cache poisoning and runtime extraction of an OpenID Connect (OIDC) token from runner process memory. "No npm tokens were stolen and the npm publish workflow itself was not compromised," TanStack clarified. The malicious package versions contained a newly added router_init.js file. Socket described the file as a heavily obfuscated 2.3MB payload with daemonization, access to GitHub-related environment variables, temporary file staging and remote dispatch behavior. Socket also identified an optionalDependencies entry that resolved to an orphan commit in the TanStack/router repository. That commit introduced a package named @tanstack/setup and a prepare lifecycle hook, allowing code to execute automatically during installation. StepSecurity said the compromised packages carried valid SLSA Build Level 3 provenance attestations because the attacker abused the legitimate release pipeline. "SLSA provenance confirms which pipeline produced the artifact, not whether the pipeline was behaving as intended," the company said. "A compromised build step can produce a validly-attested but malicious package." Campaign Spreads Across npm and PyPI Wiz attributed the activity with high confidence to TeamPCP, which it linked to earlier compromises affecting SAP, Checkmarx, Bitwarden, Lightning, Intercom and Trivy. The Wiz analysis said the payload targets GitHub Actions OIDC, GitLab, CircleCI, AWS, Google Cloud Platform, Azure, Kubernetes, HashiCorp Vault and package registry tokens. The malware used three exfiltration routes, according to Wiz: Typosquat domain git-tanstack[.]com Session messenger network GitHub API dead drops using stolen tokens Wiz also observed a gh-token-monitor daemon on developer machines. The daemon polled GitHub every 60 seconds and could attempt to wipe the user's home directory if a monitored token was revoked, although Wiz said it exited automatically after 24 hours. The campaign later expanded beyond TanStack. Socket said additional compromised artifacts included OpenSearch npm versions, PyPI mistralai 2.4.6, PyPI guardrails-ai 0.10.1 and further @squawk packages. The GitHub Advisory Database rated the TanStack issue critical and warned that any developer or continuous integration environment that installed an affected version on May 11, 2026, should be considered compromised. It advised rotating credentials reachable from the install process and reviewing cloud audit logs for activity from affected hosts.

Over 170 packages across multiple high-profile NPM and PyPI projects were compromised in a new, coordinated Mini Shai-Hulud software supply chain attack. The campaign hit 42 TanStack packages, 65 UiPath packages, Mistral AI’s PyPi packages, the OpenSearch JavaScript client, over a dozen Squawk packages, the Guardrails AI PyPI package, and other popular modules. TeamPCP, the infamous hacking group that orchestrated several supply chain attacks across multiple open source software ecosystems over the past few months, was blamed for the campaign. Dead-drop commit branch names used in the attack are taken from Frank Herbert’s Dune saga, and the malware’s repositories have the “Shai-Hulud: Here We Go Again” description. The same as in previous campaigns, the Mini Shai-Hulud worm targets sensitive information, including developer credentials, API keys, tokens, cloud credentials and secrets, cryptocurrency wallets, and secrets associated with AI tools and messaging applications. It attempts to propagate by using compromised NPM and GitHub Actions tokens to publish malicious versions of the packages the victim has write access to. The malware was also observed installing a persistent daemon to poll GitHub every minute, to verify for token revocation, and checking the system language to avoid infecting Russian users, cybersecurity firm Wiz notes. The TanStack attack The new supply chain campaign was flagged shortly after malicious package artifacts were published through the legitimate TanStack release pipeline, and was then observed spreading to additional packages. Unlike previous TeamPCP intrusions, which relied on stolen secrets to compromise accounts and modify packages, the TanStack attack chained three known security weaknesses to release 84 malicious artifacts across 42 packages. The attackers staged their payload in a GitHub fork, injected the payload into published NPM tarballs, and then hijacked the project’s CI/CD pipeline to publish the packages directly to NPM, exploiting the ambient OIDC token in the workflow to bypass the workflow’s own publish step, StepSecurity explains. “The attacker chained three known vulnerability classes — a pull_request_target ‘Pwn Request’ misconfiguration, GitHub Actions cache poisoning across the fork↔base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process,” TanStack explains in a post-mortem. According to Wiz, the attackers renamed their TanStack/router repository fork to zblgg/configuration, then opened a pull request to trigger the pull_request_target workflow, which executed the attackers’ code and poisoned the GitHub Actions cache. “When legitimate maintainer PRs were later merged to main, the release workflow restored the poisoned cache. Attacker-controlled binaries then extracted OIDC tokens directly from the GitHub Actions runner’s process memory,” Wiz explains. The stolen GitHub OIDC token allows the attackers to obtain a signing certificate and make the malicious packages appear as having a valid SLSA provenance. Thus, the packages were published under a trusted identity. “SLSA provenance is a cryptographic certificate, generated by Sigstore, that is meant to verify a package was built from a trusted source. The worm was able to produce these certificates because it hijacked the legitimate build pipeline itself,” Snyk notes. By exploiting this mechanism, the attackers published two malicious versions of each of the 42 TanStack packages. The payload Across all compromised TanStack packages, the same 2.3 MB implant (router_init.js) was injected directly into the package tarball. The obfuscated single-line JavaScript file contains a multi-stage credential stealer that performs data harvesting and exfiltration, achieves persistence, and can self-destruct. According to Socket, the implant first fingerprints the environment (operating system, CI platform, and JavaScript runtime), packs different credential harvest paths for Linux and macOS, and performs an online lookup, likely to test network reachability. “It systematically sweeps every major secrets plane available inside modern cloud-native CI environments, using both direct environment variable reads and active API calls,” Socket explains. Stolen credentials are exfiltrated via three channels: the https://git-tanstack[.]com domain, Session network (encrypted exfiltration via *.getsession.org), and Dune-themed GitHub repositories created using stolen tokens. “The Session network channel is new. Decentralized and takedown-resistant, it is significantly harder to disrupt than dedicated domains or GitHub-based exfiltration,” Wiz notes. For NPM propagation, the worm exploits the GitHub Actions OIDC federation mechanism “to mint a valid NPM publish token on behalf of the compromised CI identity,” Socket explains. Additionally, the worm uses the GitHub GraphQL API to commit copies of itself to the branches of the compromised maintainers’ source repositories. The commit author is spoofed to impersonate the Anthropic Claude Code GitHub App. The Python variant Malicious versions of the Guardrails AI and Mistral AI PyPI packages contained a different payload than the NPM one, Wiz says. The Guardrails AI package contained 13 lines of new code designed to fetch and execute a non-obfuscated payload from git-tanstack[.]com. The payload is a modular credential stealer that would only execute on Linux systems. The malware harvests extensive credentials and, for the first time, also targets password managers such as 1Password and Bitwarden. When executed on systems with Israel or Iran locales, the malware would attempt to play an MP3 file at full volume and to delete the files on the system. 170+ affected packages What makes the latest TeamPCP supply chain attack notable is the abuse of provenance attestation to publish malicious packages that are indistinguishable from legitimate ones, Snyk notes. In total, on May 11, the campaign hit over 170 packages across multiple high-profile projects. At least 401 malicious package artifacts were published within a five-hour window, SafeDep says. Some of the affected packages, such as those in the TanStack namespace, have millions of weekly downloads. The TanStack Router package is used in applications across React, Vue, and Solid. TeamPCP compromised the official Mistral AI packages across three distribution channels: the core SDK, the Azure integration, and the GCP integration. Three malicious versions of each were published. The attackers hit 65 UiPath NPM packages, publishing 65 malicious versions across the entire automation platform. The official OpenSearch JavaScript client was also compromised, and the attackers published five malicious versions of 20 Squawk packages. Users are advised to check if any compromised version of the affected packages reached their environments, clean up their systems, and rotate all potentially compromised credentials and secrets. They should also audit GitHub Actions OIDC configurations and pull_request_target workflows for cache poisoning, and implement behavioral analysis at install time as an additional protection mechanism alongside provenance verification, Snyk notes. Related: Checkmarx Jenkins AST Plugin Compromised in Supply Chain Attack Related: Build Application Firewalls Aim to Stop the Next Supply Chain Attack Related: SailPoint Discloses GitHub Repository Hack Related: Vendor Says Daemon Tools Supply Chain Attack Contained

TeamPCP, the threat actor behind the recentsupply chain attack spree, has been linked to the compromise of the npm and PyPI packages from TanStack, UiPath, Mistral AI, OpenSearch, and Guardrails AI as part of a fresh Mini Shai-Hulud campaign. The affected npm packages have been modified to include an obfuscated JavaScript file ("router_init.js") that's designed to profile the execution environment and launch a comprehensive credential stealer capable of targeting cloud providers, cryptocurrency wallets, AI tools, messaging apps, and CI systems, including Github Actions, multiple reports from Aikido Security, Endor Labs, SafeDep, Socket, StepSecurity, and Snyk show. The data is exfiltrated to the "filev2.getsession[.]org" domain. Using Session Protocol infrastructure is a deliberate attempt on the part of the attackers to evade detection, as the domain is unlikely to be blocked within enterprise environments, given that it belongs to a decentralized, privacy-focused messaging service. As a fallback option, the encrypted data is committed to attacker-controlled repositories under the author name "[email protected]" via the GitHub GraphQL API using the stolen GitHub tokens. The malware is also capable of establishing persistence hooks in Claude Code and Microsoft Visual Studio Code (VS Code) to survive reboots and re-execute the stealer on every launch of the IDEs. Furthermore, it installs a gh-token-monitor service to monitor and re-exfiltrate GitHub tokens, and injects two malicious GitHub Actions workflows to serialize repository secrets into a JSON object and upload the data to an external server ("api.masscan[.]cloud"). Unlike the previous SAP wave, where the compromised packages added a preinstall hook to trigger the infection sequence, the latest TanStack cluster adopts a different strategy by including a JavaScript file within the package tarball and adding an optional dependency that points to a GitHub-hosted package. The GitHub dependency contains a prepare lifecycle hook that executes the JavaScript payload via the Bun runtime. The updates to the Mistral AI packages, on the other hand, follow the earlier approach, replacing the contents of the "package.json" file with a preinstall hook to invoke "node setup.mjs," which downloads Bun and runs the same JavaScript malware. The TanStack supply chain compromise has been assigned the CVE identifier CVE-2026-45321. It carries a CVSS score of 9.6 out of a maximum of 10.0, indicating critical severity. The incident has impacted 42 packages and 84 versions across the TanStack ecosystem. TanStack has since traced the compromise to a chained GitHub Actions attack involving the "pull_request_target" trigger, GitHub Actions cache poisoning, and runtime memory extraction of an OIDC token from the GitHub Actions runner process. "No npm tokens were stolen, and the npm publish workflow itself was not compromised," TanStack said. Specifically, the attackers are assessed to have staged the malicious payload in a GitHub fork via an orphaned commit, injected it into published npm tarballs, then hijacked the project's legitimate "TanStack/router" workflow to publish the compromised versions with valid SLSA provenance. "The attack published malicious versions through the project's own GitHub Actions release pipeline using hijacked OIDC tokens," StepSecurity researcher Ashish Kurmi said. "In an extremely rare escalation, the compromised packages carry valid SLSA Build Level 3 provenance attestations, making this the first documented npm worm that produces validly attested malicious packages. The worm has since spread beyond TanStack to packages from UiPath, DraftLab, and other maintainers." The attack is noteworthy for the fact that it abuses trusted publishing, allowing attacker-controlled code running within a workflow to leverage its OIDC permissions to "mint" a short-lived publish token during the build and use it to publish the packages without having to steal an npm token. What makes the worm stand out is its ability to spread itself to other packages by locating a publishable npm token with bypass_2fa set to true, enumerating every package published by the same maintainer, and exchanging a GitHub OIDC token for a per-package publish token to sidestep traditional authentication entirely. "The orphaned commit additionally triggered a GitHub Actions workflow run against the legitimate TanStack/router workflow surface," Endor Labs researcher Peyton Kennedy said. "Because the repository's OIDC trusted publisher configuration granted trust at the repository level rather than scoped to a specific protected branch and workflow file, the workflow run triggered by that commit was able to request a valid short-lived npm publish token." Another new behavior introduced in the obfuscated JavaScript malware is the installation of a dead-man's switch that uses a shell script to periodically check if an npm token created by the malware is not revoked by polling the "api.github.com/user" endpoint every 60 seconds. The token has the description "IfYouRevokeThisTokenItWillWipeTheComputerOfTheOwner." Should the developer revoke the token from their npm dashboard, the script triggers a destructive routine that executes "rm -rf ~/" on the infected machine, essentially turning it into a wiper malware. These changes indicate that TeamPCP is growing aggressive and evolving its tradecraft with every campaign. It's therefore essential that developers do not revoke the npm tokens before isolating and imaging the system. "This campaign reflects a broader shift in supply chain attacks from isolated package compromise to identity-driven propagation through trusted CI/CD infrastructure," Avital Harel, security research lead at Upwind, said in a statement shared with The Hacker News. "Once attackers gain access to publishing workflows and pipeline identities, the software delivery process itself becomes the distribution mechanism. The challenge for defenders is that much of this activity can appear legitimate on the surface, which makes behavioral visibility during installs and builds increasingly important." Besides TanStack, the Mini Shai-Hulud campaign has also spread to several other packages, including some in PyPI - [email protected] (PyPI) [email protected] (PyPI) @opensearch-project/[email protected], 3.6.2, 3.7.0, and 3.8.0 @squawk/[email protected] @squawk/[email protected] @squawk/[email protected] @tallyui/[email protected], 1.0.2, and 1.0.3 @tallyui/[email protected], 1.0.2, and 1.0.3 According to data from OX Security, the incident has affected over 170 packages spanning both the npm and PyPI registries. The packages have more than 518 million downloads cumulatively. No less than 400 repositories with stolen credentials have been created as part of the attack wave. All the repositories contain the string "Shai-Hulud: Here We Go Again." Google-owned Wiz said the payload also exfiltrates stolen credentials via a third redundant channel, a typosquat domain named "git-tanstack[.]com," along with the Session messenger network and GitHub API dead drops using the stolen token, adding the trojanized PyPI packages associated with both Mistral AI and Guardrails AI contain the same malware, which "operates notably differently" from the JavaScript versions distributed via npm. Microsoft, in its analysis of the malicious mistralai PyPI package, said it's designed to download a credential stealer from a remote server ("83.142.209[.]194") that includes country-aware logic to avoid Russian-language environments and a "geofenced destructive branch that has a 1-in-6 chance of executing rm -rf / when the system appears to be in Israel or Iran." Mistral AI has published two advisories related to the compromise of its npm and PyPI packages, confirming that it was impacted by a supply chain attack related to the TanStack security incident. "Current investigation indicates that an affected developer device was involved," it said. "The [email protected] compromise is especially notable because the malicious code executes on import," Socket said. "The package checks for Linux systems, downloads a remote Python artifact from https://git-tanstack.com/transformers.pyz, writes it to /tmp/transformers.pyz, and executes it with python3 without integrity verification." "This latest activity shows the campaign continuing to propagate across both npm and PyPI, with affected packages spanning search infrastructure, AI tooling, aviation-related developer packages, enterprise automation, frontend tooling, and CI/CD-adjacent ecosystems." (The story was updated after publication to include additional insights.)