Executive brief
Multiple popular TanStack JavaScript libraries were compromised via a supply chain attack, resulting in the publication of malicious versions to the npm registry. These malicious versions contain code that automatically steals sensitive information, including cloud credentials (AWS, GCP), GitHub tokens, and SSH keys, from any developer machine or server where they are installed. This could lead to full account takeovers, data breaches, and further spread of the malware to other software projects.
Technical details
An attacker compromised the TanStack npm publishing pipeline by chaining a 'pull_request_target' misconfiguration, GitHub Actions cache poisoning, and runtime memory extraction of OIDC tokens. This allowed the unauthorized publication of 84 malicious versions across 42 packages. The malware executes during the npm install lifecycle via a hidden 'optionalDependencies' entry pointing to a malicious git commit. Once active, it harvests credentials from environment variables, local config files (~/.ssh, ~/.npmrc), and cloud metadata services (IMDS), exfiltrating them via the Session/Oxen messenger network. It also attempts to self-propagate by identifying and infecting other packages maintained by the victim.
Affected products
- TanStack @tanstack/arktype-adapter 1.166.12, 1.166.15
- TanStack @tanstack/react-router 1.169.5, 1.169.8
- TanStack @tanstack/router-core 1.169.5, 1.169.8
- TanStack @tanstack/solid-router 1.169.5, 1.169.8
- TanStack @tanstack/vue-router 1.169.5, 1.169.8
Timeline
- 2026-05-11: exploited: Malicious versions first published to npm registry
- 2026-05-11: other: Last malicious version published in the initial wave
- 2026-05-12: advisory: GitHub Advisory published