Mini Shai-Hulud hijacked TanStack's own build pipeline to poison npm

A supply chain attack this week proves that even the best crypto signatures won’t save you when the build machine itself turns against you.

On May 11, between 19:20 and 19:26 UTC, someone slipped 84 malicious artifacts into npm under the @tanstack namespace. They didn’t steal a password. They didn’t phish a maintainer. They hijacked TanStack’s legitimate GitHub Actions release pipeline and used its own OIDC identity to publish the bad packages with valid, trusted signatures.

The result is CVE-2026-45321, a critical worm with a CVSS score of 9.6. It is also the first documented npm malware to ship with valid SLSA Build Level 3 provenance. Sigstore verified the build was correct. The build was just building attacker-controlled code.

Here’s how it worked. The threat actor, identified as TeamPCP, staged a malicious payload in a GitHub fork via an orphaned commit. That commit triggered the project’s legitimate pull_request_target workflow, poisoned the GitHub Actions cache, and extracted an OIDC token straight from the runner’s memory at runtime. With that token, the attacker minted a short-lived npm publish token and pushed the compromised versions through TanStack’s own pipeline.

The payload, a file called router_init.js, is nasty. It profiles the environment and launches a credential stealer targeting cloud providers, cryptocurrency wallets, AI tools like Claude Code, messaging apps, and CI systems including GitHub Actions. Exfiltration goes out through a Session Protocol domain to evade corporate blocklists. As a fallback, stolen data gets committed to attacker-controlled GitHub repos using the author name [email protected] and stolen GitHub tokens via the GraphQL API.

The worm also establishes persistence. It hooks Claude Code and VS Code so the stealer re-executes on every IDE launch. It installs a gh-token-monitor service to keep siphoning GitHub tokens. And it injects malicious GitHub Actions workflows that serialize repository secrets into JSON and upload them to an external server.

What makes this a worm rather than a one-off breach is the self-propagation. Once inside, it hunts for publishable npm tokens with 2FA bypass enabled, enumerates every package from the same maintainer, and exchanges GitHub OIDC tokens for per-package publish tokens. Within hours it had jumped from TanStack to Mistral AI, UiPath, OpenSearch, Guardrails AI, and others. Over 160 packages are confirmed compromised so far.

@tanstack/react-router alone sees more than 12 million weekly downloads. Millions of developers and CI pipelines pulled the malicious versions before npm pulled them down.

TanStack’s post-mortem is unusually transparent. They traced the compromise to a chained GitHub Actions attack and confirmed no npm tokens were stolen directly. The publish workflow itself was not compromised in the traditional sense. It was hijacked. The attacker abused trusted publishing, a feature meant to eliminate long-lived secrets, by running attacker code inside a workflow that had permission to mint its own publish tokens.

The fix is not simple. Snyk, Endor Labs, Socket, Aikido, StepSecurity, and SafeDep all published detailed remediation guides today. The advice is grim: if you installed any affected @tanstack package on May 11, treat the entire install environment as compromised. Do not just rotate secrets. First remove persistence hooks from your IDEs and CI systems, then rotate every secret accessible from that host, then audit every GitHub Actions OIDC configuration and pull_request_target workflow in your organization.

This attack rewrites the playbook for supply chain security. SLSA provenance, OIDC trusted publishing, and automated release pipelines were supposed to make open source distribution safer. TeamPCP turned every one of those protections into a feature.