📊 Full opportunity report: Three Public Vulnerabilities. Chained. on ThorstenMeyerAI.com — validation score, market gap, and execution plan.
TL;DR
An attacker exploited three chained vulnerabilities, all previously documented in public research, to compromise TanStack npm packages on May 11, 2026. The attack demonstrates how public research can be weaponized faster than defenses can respond.
On May 11, 2026, attackers exploited a chain of three publicly documented vulnerabilities to compromise the TanStack npm packages, marking a significant escalation in supply-chain attack techniques that leverage known research. The attack was carried out via GitHub Actions workflows, without theft of tokens or direct repository access, but through a sequence of technical weaknesses that had been publicly disclosed over the previous year.
The attack involved creating a malicious fork of the TanStack/router repository, injecting a malicious commit, and then exploiting the pull_request_target pattern to execute malicious code during the release process. This chain leveraged three vulnerabilities: the dangerous pull_request_target pattern, cache poisoning across trust boundaries, and extraction of OIDC tokens from GitHub Actions runners, all of which had been documented in security research prior to the incident.
Specifically, the attacker used a forged identity to create a fork on May 10, then committed a malicious payload to this fork. The malicious commit was designed to be fetched during the CI/CD process. On May 11, the attacker opened a pull request that triggered the malicious code execution via the trusted-publisher workflow. The attacker then minted malicious npm package versions within six minutes, without stealing npm tokens, but by exfiltrating credentials through an encrypted messaging protocol embedded in the attack chain.
Investigations confirm that no individual vulnerability alone would have enabled this attack; it was the combination that bridged trust boundaries, allowing malicious code execution during the package release process. The attack exploited publicly known weaknesses documented in research reports by GitHub Security Lab, Adnan Khan, and StepSecurity, all published over the previous 12 months.
Three public vulnerabilities.
Chained.
The TanStack npm compromise of May 11, 2026 — published research recombined into working tradecraft, weaponized faster than defenders deploy mitigations.
84 malicious versions across 42 packages. Six-minute publish window. No npm tokens stolen. OIDC minted in memory and exfiltrated via Session Protocol. Three vulnerabilities chained — each documented in public research 12-24 months before the attack. Same date as the GTIG zero-day disclosure. The composition is the attack surface.
Each bridges the trust boundary the others assumed.
PR fork code crossing into base-repo cache. Base-repo cache crossing into release-workflow runtime. Release-workflow runtime crossing into npm registry write access. The composition only works because each vulnerability bridges the trust boundary the others assumed.
pull_request_target for fork PRs and checked out the fork’s PR-merge ref to run a build. Bypasses first-time-contributor approval gate. Author attempted trust split but missed that actions/cache@v5‘s post-job save is not gated by permissions:. Cache scope is per-repo, shared across triggers.Linux-pnpm-store-${hashFiles('**/pnpm-lock.yaml')} — exact match. actions/cache@v5 post-step saves poisoned store to that key. Restored entirely as designed when release.yml next runs on push to main.id-token: write for legitimate npm OIDC trusted publishing. Poisoned cache invokes attacker binaries: locate Runner.Worker via /proc/*/cmdline, dump memory via /proc//maps + /proc//mem , extract OIDC token, POST to registry.npmjs.org. Bypasses workflow’s Publish Packages step entirely.The attacker did not invent novel tradecraft. They recombined published research. Verbatim Python script — attribution comment preserved — from the March 2025 tj-actions disclosure. Every defensive research publication becomes attacker reference material within 12-24 months.
IoT Supply Chain Security Risk Analysis and Mitigation: Modeling, Computations, and Software Tools (SpringerBriefs in Computer Science)
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
May 10 17:16 fork. May 11 19:50 detection.
From the attacker creating a renamed fork (deliberately evading fork-list searches) through the cache poisoning phase, the detonation phase, and the rapid external detection by Ashish Kurmi at StepSecurity. The TanStack postmortem published the complete root cause analysis publicly within hours.
PHASE
65bf499d authored by fabricated identity claude (NOT real Anthropic Claude). [skip ci] prefix suppresses CI on push. Adds packages/history/vite_setup.mjs — ~30,000-line bundled JS payload.PREP
pull_request_target. No first-time-contributor approval — pull_request_target bypasses that gate. pr.yml blocked.TRIGGER
65bf499d on PR head. bundle-size.yml’s benchmark-pr job checks out refs/pull/7378/merge, runs pnpm install + pnpm nx run @benchmarks/bundle-size:build. Executes fork-controlled vite_setup.mjs.EXEC
Linux-pnpm-store-6f9233a50def742c09fde54f56553d6b449a535adf87d4083690539f49ae4da11 (1.1 GB) saved for TanStack/router, scoped to refs/heads/main. Keyed to match what release.yml will compute on next push.ACTIVE
b1c061af). Visible PR diff is 0-file no-op. PR closed and branch deleted in same minute. Cache poison persists. PR appears benign in retrospective review./proc/*/cmdline, dumps memory, extracts OIDC token, POSTs to registry.npmjs.org. Bypasses defined Publish Packages step entirely.EXEC
@tanstack/history@1.161.12 etc. Six minutes between the two publish waves. Workflow status: failure (tests broke; publish still happened).BLAST
DETECTION
COMPLETE
DevOps with GitHub Actions: A Practical Guide to Building Secure, Scalable, and Production-Ready CI/CD Automation Pipelines
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
160+ packages. One worm. Same threat actor.
The TanStack compromise is one node in the broader Mini Shai-Hulud campaign by threat group TeamPCP — the same actor behind LiteLLM PyPI (March 2026), Bitwarden CLI npm, SAP CAP npm, and Lightning PyPI (April 30, 2026). Self-propagating worm pattern. First documented npm worm with valid SLSA Build Level 3 attestations.
May 2026 wave
weekly downloads
compromised May 12
fork → detection
registry.npmjs.org/-/v1/search?text=maintainer: → republish with same injection. Active operational campaign as of May 12, 2026.npm package vulnerability scanner
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
IOCs · copy-pasteable for hunting queries.
The TanStack postmortem published comprehensive IOCs. Defenders should hunt for these across their environments. The attacker forged a “claude” identity using claude@users.noreply.github.com — not the real Anthropic Claude Code GitHub App. This identity-confusion tactic deserves specific attention in git-log audits.
bun run tanstack_runner.js && exit 1 on install — payload runs, then optional dep “fails” gracefully.router_init.js (~2.3 MB, package root, not in files array). Also: tanstack_runner.js per Socket analysis.https://litter.catbox.moe/h8nc9u.js, https://litter.catbox.moe/7rrc6l.mjs. Secondary exfil via legitimate-looking GitHub GraphQL API traffic.git log --all --author=claude@users.noreply.github.com across all repos. Force-push revert if found.zblgg (id 127806521) · voicproducoes (id 269549300 · account created 2026-03-19 — fresh account, public repos named “A Mini Shai-Hulud has Appeared”). Attacker fork: github.com/zblgg/configuration (renamed). Workflow runs: 25613093674 · 25691781302.
Automating DevOps with GitLab CI/CD Pipelines: Build efficient CI/CD pipelines to verify, secure, and deploy your code using real-life examples
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Installed it? Rotate. Maintain packages? Audit.
Three response tracks. If you installed an affected version on May 11: treat your host as compromised. If you maintain OSS with similar workflow patterns: audit pull_request_target immediately. If you consume the npm ecosystem at enterprise scale: deploy install-time monitoring and lockfile pinning.
- Rotate AWS, GCP, Azure, Kubernetes service-account tokens, Vault tokens, npm
~/.npmrc, GitHub tokens, SSH private keys - Review GitHub Actions runs after 2026-05-11T19:20Z for unexpected npm publish events
- Check outbound connections to
filev2.getsession.org·seed*.getsession.org - Check downstream propagation — if your packages were published during a CI run that installed compromised version, those may also be compromised
- Audit
~/.claude/+.vscode/tasks.json· removerouter_runtime.js,setup.mjs git log --all --author=claude@users.noreply.github.com· revert if found- Run
npm token list· revoke unrecognized tokens
- Audit pull_request_target workflows immediately · never check out fork-submitted code without explicit approval gates
- Pin third-party action refs to commit SHAs ·
actions/checkout@8e5e7e5ab8...not@v6 - Separate cache scopes for trusted vs untrusted contexts · explicit
restore-keysandkeypatterns - Consider moving from OIDC trusted publisher to short-lived classic tokens with manual review
- Add internal alerting on npm publishes · fire on any publish that doesn’t originate from expected workflow step
- Audit other repos for the same bundle-size.yml-style pattern
- Restrict
id-token: writeto only the publish step that needs it
- Deploy npm package monitoring at install time · Socket / StepSecurity / Snyk · Socket flagged TanStack in 6 minutes
- Lockfile-pinned dependencies don’t auto-pull new versions · only consumers installing during the publish window were affected
- Audit lockfiles for
github:URLoptionalDependencies· unusual for production deps, exact pattern used here - CI/CD secret rotation automation · 30-90 day schedule regardless of incident status
- Treat provenance attestations as one layer, not sole verification · Mini Shai-Hulud produces valid Build L3 attestations on malicious packages
- Establish IR playbooks for OSS supply-chain compromise scenarios
Three pieces of public security research. Twelve months between the latest and the attack. Zero novel attacker tradecraft. A competent maintainer team with 2FA and OIDC trusted publishing — compromised through a chain that no individual vulnerability in their stack would have enabled. The composition is the attack surface.
Implications of Public Research-Driven Attacks
This incident underscores how publicly available security research can be weaponized rapidly, outpacing the deployment of mitigations. It demonstrates that the most impactful supply-chain attacks in 2026 are less about novel exploits and more about combining known vulnerabilities in sophisticated ways. For open-source maintainers and enterprise developers, this highlights the urgent need to reassess trust boundaries and implement layered defenses against chain exploits.
Broader Supply-Chain Security Trends in 2026
The TanStack attack is part of a wider wave of supply-chain compromises in 2026, including over 160 packages affected in the Mini Shai-Hulud campaign, which also impacted companies like Mistral AI, UiPath, and Squawk. The incident follows the disclosure of a zero-day by Google Threat Intelligence Group on the same day, illustrating the convergence of AI-augmented offensive techniques and publicly documented vulnerabilities exploited at scale. The attack chain reflects a pattern where attacker tradecraft is rapidly derived from open research, enabling faster deployment than defenders can adapt.
Prior to this event, each of the three vulnerabilities had been publicly documented: the dangerous pull request pattern (GitHub Security Lab, 2019), cache poisoning across trust boundaries (Adnan Khan, 2024), and OIDC token extraction from runners (StepSecurity, 2025). These findings, when combined, create a potent attack vector that was exploited in this incident.
“The TanStack incident exemplifies how publicly available security research can be weaponized in real-world attacks faster than defenders can deploy mitigations.”
— Thorsten Meyer
Remaining Uncertainties in Attack Scope and Mitigations
It is not yet clear whether additional packages or repositories have been similarly compromised using this or related chains. The full extent of the exfiltrated credentials and potential subsequent attacks remains under investigation. The effectiveness of current mitigations against such chained exploits is also still being evaluated, and the speed at which defenders can deploy patches continues to lag behind attacker tradecraft deployment.
Next Steps for Security Response and Defense Strategies
Security teams are expected to analyze the attack chain thoroughly and develop targeted mitigations, including revising workflows to eliminate reliance on vulnerable patterns like pull_request_target. There will likely be increased scrutiny of trust boundaries within CI/CD pipelines, alongside efforts to detect chained vulnerabilities proactively. The broader open-source and enterprise communities are also urged to review their dependencies and trust models to prevent similar exploits.
Key Questions
How did the attacker exploit these vulnerabilities without stealing npm tokens?
The attacker minted malicious package versions by exfiltrating credentials through an encrypted messaging protocol embedded in the attack chain, avoiding the need to steal npm tokens directly.
Are these vulnerabilities still exploitable today?
Since the vulnerabilities are publicly documented, mitigation depends on the deployment of updated workflows and security controls. The attack chain relies on specific trust boundary crossings, which can be addressed with best practices and mitigations.
What should open-source maintainers do to prevent similar attacks?
Maintain an awareness of known vulnerabilities, avoid risky patterns like pull_request_target in untrusted code, implement layered security controls, and monitor for anomalous activity in CI/CD pipelines.
Does this attack mean all open-source packages are vulnerable?
Not necessarily; the attack exploited specific known vulnerabilities in a chain. However, it highlights the importance of secure development practices and vigilance across the ecosystem.
Source: ThorstenMeyerAI.com
