📊 Full opportunity report: Three Public Vulnerabilities. Chained. on ThorstenMeyerAI.com — validation score, market gap, and execution plan.
TL;DR
An attacker exploited a chain of three publicly known vulnerabilities to compromise TanStack npm packages on May 11, 2026. The attack used existing research and was executed faster than defenses could respond, exemplifying the evolving threat landscape.
On May 11, 2026, attackers exploited a chain of three publicly documented vulnerabilities to compromise the TanStack npm packages, using existing research to weaponize the attack faster than defenders could deploy mitigations. The incident underscores the increasing sophistication of supply chain attacks driven by publicly available exploit techniques.
The attack involved publishing 84 malicious versions of TanStack packages within six minutes, using a compromised GitHub Actions workflow that was trusted via OIDC binding. The attacker created a fork of the repository, injected malicious code via a commit, and used a pull request targeting the main branch to trigger the malicious release. The attack did not involve theft of npm tokens; instead, the attacker minted an in-memory OIDC token and exfiltrated credentials through an encrypted messaging protocol, avoiding traditional C2 infrastructure.
Forensic analysis revealed that three vulnerabilities, each documented in public security research before 2026, were chained to enable the attack: the pull_request_target “Pwn Request” pattern (GitHub Security Lab), cache poisoning across fork-base trust boundaries (Adnan Khan, May 2024), and OIDC token extraction from GitHub Actions runner memory (StepSecurity, March 2025). Each vulnerability alone was insufficient; their combination bridged multiple trust boundaries, allowing the attacker to escalate privileges and inject malicious code.
This incident is part of a broader wave of supply chain compromises in May 2026, affecting over 160 packages in the Mini Shai-Hulud campaign, including notable names like Mistral AI and UiPath. The attack was executed within hours of the first AI-built zero-day disclosure by Google Threat Intelligence Group, illustrating a convergence of offensive techniques fueled by public research.
Three public vulnerabilities.
Chained.
The TanStack npm compromise of May 11, 2026 — published research recombined into working tradecraft, weaponized faster than defenders deploy mitigations.
84 malicious versions across 42 packages. Six-minute publish window. No npm tokens stolen. OIDC minted in memory and exfiltrated via Session Protocol. Three vulnerabilities chained — each documented in public research 12-24 months before the attack. Same date as the GTIG zero-day disclosure. The composition is the attack surface.
Each bridges the trust boundary the others assumed.
PR fork code crossing into base-repo cache. Base-repo cache crossing into release-workflow runtime. Release-workflow runtime crossing into npm registry write access. The composition only works because each vulnerability bridges the trust boundary the others assumed.
pull_request_target for fork PRs and checked out the fork’s PR-merge ref to run a build. Bypasses first-time-contributor approval gate. Author attempted trust split but missed that actions/cache@v5‘s post-job save is not gated by permissions:. Cache scope is per-repo, shared across triggers.Linux-pnpm-store-${hashFiles('**/pnpm-lock.yaml')} — exact match. actions/cache@v5 post-step saves poisoned store to that key. Restored entirely as designed when release.yml next runs on push to main.id-token: write for legitimate npm OIDC trusted publishing. Poisoned cache invokes attacker binaries: locate Runner.Worker via /proc/*/cmdline, dump memory via /proc//maps + /proc//mem , extract OIDC token, POST to registry.npmjs.org. Bypasses workflow’s Publish Packages step entirely.The attacker did not invent novel tradecraft. They recombined published research. Verbatim Python script — attribution comment preserved — from the March 2025 tj-actions disclosure. Every defensive research publication becomes attacker reference material within 12-24 months.
Software Supply Chain Defense: Securing Build Environments, Toolchains, and CI/CD Infrastructure Against Advanced Threats
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
May 10 17:16 fork. May 11 19:50 detection.
From the attacker creating a renamed fork (deliberately evading fork-list searches) through the cache poisoning phase, the detonation phase, and the rapid external detection by Ashish Kurmi at StepSecurity. The TanStack postmortem published the complete root cause analysis publicly within hours.
PHASE
65bf499d authored by fabricated identity claude (NOT real Anthropic Claude). [skip ci] prefix suppresses CI on push. Adds packages/history/vite_setup.mjs — ~30,000-line bundled JS payload.PREP
pull_request_target. No first-time-contributor approval — pull_request_target bypasses that gate. pr.yml blocked.TRIGGER
65bf499d on PR head. bundle-size.yml’s benchmark-pr job checks out refs/pull/7378/merge, runs pnpm install + pnpm nx run @benchmarks/bundle-size:build. Executes fork-controlled vite_setup.mjs.EXEC
Linux-pnpm-store-6f9233a50def742c09fde54f56553d6b449a535adf87d4083690539f49ae4da11 (1.1 GB) saved for TanStack/router, scoped to refs/heads/main. Keyed to match what release.yml will compute on next push.ACTIVE
b1c061af). Visible PR diff is 0-file no-op. PR closed and branch deleted in same minute. Cache poison persists. PR appears benign in retrospective review./proc/*/cmdline, dumps memory, extracts OIDC token, POSTs to registry.npmjs.org. Bypasses defined Publish Packages step entirely.EXEC
@tanstack/history@1.161.12 etc. Six minutes between the two publish waves. Workflow status: failure (tests broke; publish still happened).BLAST
DETECTION
COMPLETE
npm package vulnerability scanner
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
160+ packages. One worm. Same threat actor.
The TanStack compromise is one node in the broader Mini Shai-Hulud campaign by threat group TeamPCP — the same actor behind LiteLLM PyPI (March 2026), Bitwarden CLI npm, SAP CAP npm, and Lightning PyPI (April 30, 2026). Self-propagating worm pattern. First documented npm worm with valid SLSA Build Level 3 attestations.
May 2026 wave
weekly downloads
compromised May 12
fork → detection
registry.npmjs.org/-/v1/search?text=maintainer: → republish with same injection. Active operational campaign as of May 12, 2026.
DevOps with GitHub Actions: A Practical Guide to Building Secure, Scalable, and Production-Ready CI/CD Automation Pipelines
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
IOCs · copy-pasteable for hunting queries.
The TanStack postmortem published comprehensive IOCs. Defenders should hunt for these across their environments. The attacker forged a “claude” identity using claude@users.noreply.github.com — not the real Anthropic Claude Code GitHub App. This identity-confusion tactic deserves specific attention in git-log audits.
bun run tanstack_runner.js && exit 1 on install — payload runs, then optional dep “fails” gracefully.router_init.js (~2.3 MB, package root, not in files array). Also: tanstack_runner.js per Socket analysis.https://litter.catbox.moe/h8nc9u.js, https://litter.catbox.moe/7rrc6l.mjs. Secondary exfil via legitimate-looking GitHub GraphQL API traffic.git log --all --author=claude@users.noreply.github.com across all repos. Force-push revert if found.zblgg (id 127806521) · voicproducoes (id 269549300 · account created 2026-03-19 — fresh account, public repos named “A Mini Shai-Hulud has Appeared”). Attacker fork: github.com/zblgg/configuration (renamed). Workflow runs: 25613093674 · 25691781302.
Klein Tools 80093 Cable Tester, VDV LAN Kit with LAN Tester, Pass Thru Crimper, CAT6/CAT5e Plugs and Strain Relief Boots, 5-Piece
SMART BUY: A complete, high-performance kit that offers convenience and value
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Installed it? Rotate. Maintain packages? Audit.
Three response tracks. If you installed an affected version on May 11: treat your host as compromised. If you maintain OSS with similar workflow patterns: audit pull_request_target immediately. If you consume the npm ecosystem at enterprise scale: deploy install-time monitoring and lockfile pinning.
- Rotate AWS, GCP, Azure, Kubernetes service-account tokens, Vault tokens, npm
~/.npmrc, GitHub tokens, SSH private keys - Review GitHub Actions runs after 2026-05-11T19:20Z for unexpected npm publish events
- Check outbound connections to
filev2.getsession.org·seed*.getsession.org - Check downstream propagation — if your packages were published during a CI run that installed compromised version, those may also be compromised
- Audit
~/.claude/+.vscode/tasks.json· removerouter_runtime.js,setup.mjs git log --all --author=claude@users.noreply.github.com· revert if found- Run
npm token list· revoke unrecognized tokens
- Audit pull_request_target workflows immediately · never check out fork-submitted code without explicit approval gates
- Pin third-party action refs to commit SHAs ·
actions/checkout@8e5e7e5ab8...not@v6 - Separate cache scopes for trusted vs untrusted contexts · explicit
restore-keysandkeypatterns - Consider moving from OIDC trusted publisher to short-lived classic tokens with manual review
- Add internal alerting on npm publishes · fire on any publish that doesn’t originate from expected workflow step
- Audit other repos for the same bundle-size.yml-style pattern
- Restrict
id-token: writeto only the publish step that needs it
- Deploy npm package monitoring at install time · Socket / StepSecurity / Snyk · Socket flagged TanStack in 6 minutes
- Lockfile-pinned dependencies don’t auto-pull new versions · only consumers installing during the publish window were affected
- Audit lockfiles for
github:URLoptionalDependencies· unusual for production deps, exact pattern used here - CI/CD secret rotation automation · 30-90 day schedule regardless of incident status
- Treat provenance attestations as one layer, not sole verification · Mini Shai-Hulud produces valid Build L3 attestations on malicious packages
- Establish IR playbooks for OSS supply-chain compromise scenarios
Three pieces of public security research. Twelve months between the latest and the attack. Zero novel attacker tradecraft. A competent maintainer team with 2FA and OIDC trusted publishing — compromised through a chain that no individual vulnerability in their stack would have enabled. The composition is the attack surface.
Implications for Supply Chain Security in Open Source
This incident demonstrates that publicly available security research can be weaponized rapidly, outpacing traditional mitigation efforts. It highlights the need for open-source maintainers and enterprise users to reevaluate trust boundaries, implement stricter code review processes, and monitor for chain-reaction vulnerabilities. The attack exemplifies how the attack surface has shifted from individual flaws to complex chains of known vulnerabilities, emphasizing the importance of holistic security strategies.
Broader Trends in 2026 Supply Chain Attacks
The TanStack compromise is part of a larger pattern of supply chain attacks in 2026, where over 160 packages were affected in the Mini Shai-Hulud campaign. These incidents capitalize on publicly documented vulnerabilities, often years old, which attackers combine into effective chains of exploitation. The attack on TanStack coincided with the disclosure of an AI-generated zero-day by Google Threat Intelligence Group, reflecting a broader escalation in offensive capabilities leveraging AI and open-source research.
Previous research by GitHub Security Lab, Adnan Khan, and StepSecurity had documented the individual vulnerabilities used in this chain, illustrating a persistent gap between research publication and defense deployment. The attack underscores the need for faster integration of security insights into operational defenses, especially in open-source ecosystems.
“The TanStack incident exemplifies how publicly documented vulnerabilities, when chained together, can be weaponized in a matter of minutes, outpacing traditional defenses.”
— Thorsten Meyer
Remaining Questions About Attack Scope and Impact
It is still unclear how many projects beyond TanStack were affected, and whether any malicious code was actively exploited in production environments. Details about the extent of exfiltrated data or further compromise of downstream systems remain undisclosed. The precise timeline of how quickly mitigations can be deployed versus attacker adaptation is also still unfolding.
Future Security Measures and Industry Response
Security teams are expected to enhance monitoring of supply chain trust boundaries, adopt more aggressive code review practices, and integrate vulnerability chaining detection. Open-source projects and enterprises will likely prioritize rapid response protocols for known vulnerabilities, and industry groups may push for standardized security benchmarks to prevent similar chains of attack. Continued research and collaboration are essential to close the gap between published vulnerabilities and effective defenses.
Key Questions
How did the attacker execute the chain of vulnerabilities so quickly?
The attacker combined publicly documented vulnerabilities that, when chained, bridged trust boundaries across GitHub workflows and npm publishing processes. The attack was executed within hours of the vulnerabilities being public, exploiting the fact that defenses had not yet been adapted.
Were any npm tokens stolen during the attack?
No, the attacker minted an OIDC token in memory and exfiltrated credentials via an encrypted messaging protocol, without stealing npm tokens or compromising the publish workflow directly.
What lessons can open-source maintainers learn from this incident?
Maintainers should monitor for vulnerability chains, implement stricter code review for pull requests from forks, and consider additional controls over trust boundaries in CI/CD pipelines to prevent similar exploits.
Is this type of attack preventable in the future?
While no attack is entirely preventable, implementing layered security controls, faster deployment of mitigations, and better detection of chained vulnerabilities can significantly reduce risk.
How does this incident relate to broader supply chain security concerns?
This attack exemplifies how publicly available research can be weaponized rapidly, emphasizing the need for industry-wide improvements in how vulnerabilities are managed and mitigated.
Source: ThorstenMeyerAI.com
