📊 Full opportunity report: Three Public Vulnerabilities. Chained. on ThorstenMeyerAI.com — validation score, market gap, and execution plan.
TL;DR
On May 11, 2026, attackers exploited a chain of three publicly documented vulnerabilities to compromise TanStack npm packages. The attack leveraged known security flaws in GitHub Actions and trust boundaries, highlighting the speed at which attacker tradecraft can outpace defenses.
On May 11, 2026, attackers exploited a chain of three publicly documented vulnerabilities to compromise the TanStack npm packages, using a combination of known security flaws in GitHub Actions workflows and trust boundaries. The attack did not involve theft of npm tokens but relied on in-memory OIDC token exfiltration, demonstrating how public research can be weaponized rapidly, outpacing defenders’ mitigation efforts.
The attack was carried out on May 11, 2026, when an attacker created a malicious fork of the TanStack/router repository and injected a payload through a crafted commit. The attacker then opened a pull request with a suspicious title, triggering automated workflows configured with pull_request_target, a known risky pattern documented by GitHub Security Lab years earlier. The attacker used a forged identity and crafted commit messages to evade detection.
Three vulnerabilities, each previously published in security research, were chained to facilitate the attack: the pull_request_target ‘Pwn Request’ pattern, cache poisoning across trust boundaries, and in-memory extraction of OIDC tokens from GitHub Actions runners. Each vulnerability alone was insufficient; together, they bridged trust boundaries and allowed the attacker to mint an OIDC token in memory and exfiltrate credentials via an encrypted messaging network, without stealing npm tokens or compromising the publish workflow directly.
The incident underscores how publicly available research can be rapidly weaponized, with the attack executed within hours of the vulnerabilities being publicly disclosed. The attack was part of a broader wave of supply chain compromises affecting over 160 packages, including TanStack, Mistral AI, UiPath, and others, in what security researchers term the ‘Mini Shai-Hulud’ campaign.
Three public vulnerabilities.
Chained.
The TanStack npm compromise of May 11, 2026 — published research recombined into working tradecraft, weaponized faster than defenders deploy mitigations.
84 malicious versions across 42 packages. Six-minute publish window. No npm tokens stolen. OIDC minted in memory and exfiltrated via Session Protocol. Three vulnerabilities chained — each documented in public research 12-24 months before the attack. Same date as the GTIG zero-day disclosure. The composition is the attack surface.
Each bridges the trust boundary the others assumed.
PR fork code crossing into base-repo cache. Base-repo cache crossing into release-workflow runtime. Release-workflow runtime crossing into npm registry write access. The composition only works because each vulnerability bridges the trust boundary the others assumed.
pull_request_target for fork PRs and checked out the fork’s PR-merge ref to run a build. Bypasses first-time-contributor approval gate. Author attempted trust split but missed that actions/cache@v5‘s post-job save is not gated by permissions:. Cache scope is per-repo, shared across triggers.Linux-pnpm-store-${hashFiles('**/pnpm-lock.yaml')} — exact match. actions/cache@v5 post-step saves poisoned store to that key. Restored entirely as designed when release.yml next runs on push to main.id-token: write for legitimate npm OIDC trusted publishing. Poisoned cache invokes attacker binaries: locate Runner.Worker via /proc/*/cmdline, dump memory via /proc//maps + /proc//mem , extract OIDC token, POST to registry.npmjs.org. Bypasses workflow’s Publish Packages step entirely.The attacker did not invent novel tradecraft. They recombined published research. Verbatim Python script — attribution comment preserved — from the March 2025 tj-actions disclosure. Every defensive research publication becomes attacker reference material within 12-24 months.
Accelerate DevOps with GitHub: Enhance software delivery performance with GitHub Issues, Projects, Actions, and Advanced Security
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
May 10 17:16 fork. May 11 19:50 detection.
From the attacker creating a renamed fork (deliberately evading fork-list searches) through the cache poisoning phase, the detonation phase, and the rapid external detection by Ashish Kurmi at StepSecurity. The TanStack postmortem published the complete root cause analysis publicly within hours.
PHASE
65bf499d authored by fabricated identity claude (NOT real Anthropic Claude). [skip ci] prefix suppresses CI on push. Adds packages/history/vite_setup.mjs — ~30,000-line bundled JS payload.PREP
pull_request_target. No first-time-contributor approval — pull_request_target bypasses that gate. pr.yml blocked.TRIGGER
65bf499d on PR head. bundle-size.yml’s benchmark-pr job checks out refs/pull/7378/merge, runs pnpm install + pnpm nx run @benchmarks/bundle-size:build. Executes fork-controlled vite_setup.mjs.EXEC
Linux-pnpm-store-6f9233a50def742c09fde54f56553d6b449a535adf87d4083690539f49ae4da11 (1.1 GB) saved for TanStack/router, scoped to refs/heads/main. Keyed to match what release.yml will compute on next push.ACTIVE
b1c061af). Visible PR diff is 0-file no-op. PR closed and branch deleted in same minute. Cache poison persists. PR appears benign in retrospective review./proc/*/cmdline, dumps memory, extracts OIDC token, POSTs to registry.npmjs.org. Bypasses defined Publish Packages step entirely.EXEC
@tanstack/history@1.161.12 etc. Six minutes between the two publish waves. Workflow status: failure (tests broke; publish still happened).BLAST
DETECTION
COMPLETE
npm package vulnerability scanner
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
160+ packages. One worm. Same threat actor.
The TanStack compromise is one node in the broader Mini Shai-Hulud campaign by threat group TeamPCP — the same actor behind LiteLLM PyPI (March 2026), Bitwarden CLI npm, SAP CAP npm, and Lightning PyPI (April 30, 2026). Self-propagating worm pattern. First documented npm worm with valid SLSA Build Level 3 attestations.
May 2026 wave
weekly downloads
compromised May 12
fork → detection
registry.npmjs.org/-/v1/search?text=maintainer: → republish with same injection. Active operational campaign as of May 12, 2026.
MENGQI-CONTROL 2 Doors Smart Access Control for Fire Exit Door Rim Exit Devices with Push Bar Electric Strike Lock RFID Keypad Reader 110V Power Supply Box Keychains Cards(Phone APP Remote Open Door)
Control 2 doors, get in door by swiping card/key fob, inputting PIN code or using card + PIN,…
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
IOCs · copy-pasteable for hunting queries.
The TanStack postmortem published comprehensive IOCs. Defenders should hunt for these across their environments. The attacker forged a “claude” identity using claude@users.noreply.github.com — not the real Anthropic Claude Code GitHub App. This identity-confusion tactic deserves specific attention in git-log audits.
bun run tanstack_runner.js && exit 1 on install — payload runs, then optional dep “fails” gracefully.router_init.js (~2.3 MB, package root, not in files array). Also: tanstack_runner.js per Socket analysis.https://litter.catbox.moe/h8nc9u.js, https://litter.catbox.moe/7rrc6l.mjs. Secondary exfil via legitimate-looking GitHub GraphQL API traffic.git log --all --author=claude@users.noreply.github.com across all repos. Force-push revert if found.zblgg (id 127806521) · voicproducoes (id 269549300 · account created 2026-03-19 — fresh account, public repos named “A Mini Shai-Hulud has Appeared”). Attacker fork: github.com/zblgg/configuration (renamed). Workflow runs: 25613093674 · 25691781302.OIDC token exfiltration detection
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Installed it? Rotate. Maintain packages? Audit.
Three response tracks. If you installed an affected version on May 11: treat your host as compromised. If you maintain OSS with similar workflow patterns: audit pull_request_target immediately. If you consume the npm ecosystem at enterprise scale: deploy install-time monitoring and lockfile pinning.
- Rotate AWS, GCP, Azure, Kubernetes service-account tokens, Vault tokens, npm
~/.npmrc, GitHub tokens, SSH private keys - Review GitHub Actions runs after 2026-05-11T19:20Z for unexpected npm publish events
- Check outbound connections to
filev2.getsession.org·seed*.getsession.org - Check downstream propagation — if your packages were published during a CI run that installed compromised version, those may also be compromised
- Audit
~/.claude/+.vscode/tasks.json· removerouter_runtime.js,setup.mjs git log --all --author=claude@users.noreply.github.com· revert if found- Run
npm token list· revoke unrecognized tokens
- Audit pull_request_target workflows immediately · never check out fork-submitted code without explicit approval gates
- Pin third-party action refs to commit SHAs ·
actions/checkout@8e5e7e5ab8...not@v6 - Separate cache scopes for trusted vs untrusted contexts · explicit
restore-keysandkeypatterns - Consider moving from OIDC trusted publisher to short-lived classic tokens with manual review
- Add internal alerting on npm publishes · fire on any publish that doesn’t originate from expected workflow step
- Audit other repos for the same bundle-size.yml-style pattern
- Restrict
id-token: writeto only the publish step that needs it
- Deploy npm package monitoring at install time · Socket / StepSecurity / Snyk · Socket flagged TanStack in 6 minutes
- Lockfile-pinned dependencies don’t auto-pull new versions · only consumers installing during the publish window were affected
- Audit lockfiles for
github:URLoptionalDependencies· unusual for production deps, exact pattern used here - CI/CD secret rotation automation · 30-90 day schedule regardless of incident status
- Treat provenance attestations as one layer, not sole verification · Mini Shai-Hulud produces valid Build L3 attestations on malicious packages
- Establish IR playbooks for OSS supply-chain compromise scenarios
Three pieces of public security research. Twelve months between the latest and the attack. Zero novel attacker tradecraft. A competent maintainer team with 2FA and OIDC trusted publishing — compromised through a chain that no individual vulnerability in their stack would have enabled. The composition is the attack surface.
Implications of Public Research Exploitation in Supply Chain Attacks
This incident demonstrates that publicly documented vulnerabilities can be combined into effective attack chains, enabling sophisticated supply chain compromises at a pace faster than defenses can adapt. It highlights the urgent need for organizations to reassess trust boundaries, review workflow configurations, and implement more resilient security practices in open-source and enterprise environments. The attack exemplifies how the attack surface extends beyond individual vulnerabilities to the composition of known flaws, emphasizing the importance of holistic security strategies.
Publicly Documented Vulnerabilities and the 2026 Supply Chain Wave
The May 2026 attack on TanStack is part of a larger pattern of supply chain compromises that began with disclosures of vulnerabilities in GitHub Actions workflows and trust boundary management. Over the past year, security research has identified key weaknesses: the use of pull_request_target workflows, cache poisoning across trust boundaries, and in-memory token extraction from runners. These findings, published between March 2025 and May 2024, laid the groundwork for the attack chain exploited in this incident. The attack reflects a broader trend where attacker tradecraft rapidly incorporates public research, leading to high-impact breaches that challenge existing defenses.
“The TanStack incident exemplifies how publicly available security research can be weaponized within hours, creating an attack chain that outpaces defensive mitigation efforts.”
— Thorsten Meyer, security researcher
Unresolved Aspects of the Attack Chain and Detection Gaps
While the technical chain has been reconstructed, it remains unclear how many other repositories or workflows could be similarly exploited using the same chain of vulnerabilities. The full extent of the breach, including whether additional packages or organizations were compromised, is still under investigation. Details about the attacker’s broader operational objectives and whether additional payloads or backdoors were deployed are also not yet confirmed.
Next Steps for Mitigation and Broader Security Review
Organizations using GitHub Actions and npm packages are advised to review their trust boundary configurations, especially avoiding workflows that trigger on pull_request_target without additional safeguards. Developers and maintainers should audit their repositories for similar vulnerabilities and implement stricter access controls. Ongoing forensic analysis aims to determine the full scope of the breach and develop targeted mitigations. Industry-wide, this incident is likely to accelerate discussions around security best practices for supply chain integrity and the rapid deployment of mitigations against known vulnerabilities.
Key Questions
How did the attacker exploit known vulnerabilities to compromise TanStack?
The attacker chained three publicly documented vulnerabilities: the use of pull_request_target workflows, cache poisoning across trust boundaries, and in-memory OIDC token extraction. By exploiting these, they bypassed traditional security measures without stealing credentials or directly compromising the publish process.
What specific security flaws were used in the attack?
The attack relied on the pull_request_target pattern, known for its trust boundary issues; cache poisoning across fork and base repositories; and the extraction of OIDC tokens from GitHub Actions runners’ memory, all previously published in security research.
Are other packages or repositories at risk?
While the attack focused on TanStack, the vulnerabilities exploited are common in many workflows. The full scope of affected repositories is under investigation, but the incident underscores the need for broader security reviews across projects using similar configurations.
What can organizations do to prevent similar attacks?
Organizations should audit their GitHub Actions workflows, avoid using pull_request_target in untrusted contexts, implement strict access controls, and stay informed about known security flaws and best practices for supply chain security.
Source: ThorstenMeyerAI.com
