CVE-2026-45321: TanStack npm Supply Chain Compromise -- Credential-Stealing Malware in 42 Packages

Background

TanStack is a collection of widely-used open-source JavaScript and TypeScript libraries — including TanStack Router, TanStack Query, TanStack Table, and related packages — distributed under the @tanstack/* npm namespace. These packages are used across tens of thousands of production web applications and are routinely installed in CI/CD environments during build and test pipelines. TanStack Router and TanStack Query alone collectively receive tens of millions of npm downloads per week.

CVE-2026-45321 is a critical (CVSS 9.6) supply chain attack in which threat actors compromised TanStack’s GitHub Actions publishing pipeline on May 11, 2026, distributing malicious code across 84 artifacts spanning 42 @tanstack/* packages. Unlike attacks that rely on stolen npm credentials, this attack exploited a chain of three GitHub Actions vulnerabilities to publish malicious packages using TanStack’s own legitimate OIDC publishing identity — a technique that bypasses npm token revocation as a remediation mechanism. CISA added CVE-2026-45321 to its Known Exploited Vulnerabilities catalog on May 27, 2026.

The attack is attributed to threat actor group TeamPCP (also known as UNC6780) and is part of the broader Mini Shai-Hulud supply chain campaign, which also compromised Nx Console (CVE-2026-48027), Aqua Security Trivy (CVE-2026-33634), and Bitwarden CLI’s npm package.

Technical Mechanism

CVE-2026-45321 exploited a chain of three distinct GitHub Actions vulnerabilities to achieve trusted npm publication from within TanStack’s own release infrastructure:

Vulnerability 1: pull_request_target Pwn Request misconfiguration

TanStack’s CI workflows included a pull_request_target trigger, which runs with base repository permissions — including access to secrets and OIDC tokens — even when triggered by a fork pull request. An attacker with a plausible-looking upstream contribution could trigger the release workflow from a forked repository containing attacker-controlled code, with elevated permissions. This class of misconfiguration is documented by GitHub as “Pwn Request” and is a known risk for workflows that use pull_request_target.

Vulnerability 2: GitHub Actions cache poisoning across the fork–base boundary

TanStack’s CI used GitHub Actions cache in a way that allowed a forked repository’s workflow run to write to cache entries subsequently read by the base repository’s trusted workflows. The attacker pre-populated a cache entry containing a modified build script. When the legitimate release pipeline ran and restored from cache, it executed the attacker’s code as part of the trusted workflow.

Vulnerability 3: Runtime OIDC token extraction from the Actions runner

Once attacker-controlled code was running inside a trusted workflow context, it extracted the GitHub Actions OIDC token from the runtime environment. This short-lived token carried the trust bindings necessary to publish npm packages as TanStack’s legitimate publishing identity. The attacker used this token to publish the malicious package versions before the token expired.

Post-exploitation payload:

The malicious code injected into the packages ran as a postinstall script. On execution, it performed a systematic sweep of credential stores, exfiltrating:

• ~/.aws/credentials, ~/.aws/config, and AWS_* environment variables
• Kubernetes kubeconfig files (~/.kube/config)
• HashiCorp Vault tokens (VAULT_TOKEN environment variable and token files)
• ~/.npmrc authentication tokens
• GITHUB_TOKEN, GH_TOKEN, and similar CI credential patterns
• SSH private keys (~/.ssh/id_*)
• .env files in the current working directory and parent directories

The payload transmitted harvested data to an attacker-controlled endpoint over HTTPS.

Real-World Exploitation Evidence

The TanStack compromise was the pivot point in the broader Mini Shai-Hulud campaign. Credentials harvested from CI environments that installed compromised TanStack packages were subsequently used to:

1. Access TanStack developer workstations — specifically obtaining GitHub credentials for an Nx developer who used TanStack tooling in a shared CI environment.
2. Publish the malicious Nx Console VS Code extension (CVE-2026-48027) using those credentials.
3. Breach GitHub’s internal repositories — approximately 3,800 repos were exfiltrated using GitHub credentials harvested from developer machines running the compromised Nx Console extension.
4. Compromise Grafana Labs infrastructure through a similar credential pivot chain.

The campaign demonstrates a “harvest and pivot” pattern: each compromise enables the next, with CI environments serving as both credential repositories and lateral movement platforms. OpenAI confirmed that two developer devices were compromised through the TanStack campaign, and AI infrastructure company Mistral was separately extorted for $25,000 with stolen data from affected CI environments.

Impact Assessment

• CI/CD environment compromise: The postinstall script executes at install time in any environment that runs npm install, including developer workstations, CI runners, Docker build containers, and automated dependency update bots. Any of these environments may have had credentials silently exfiltrated.
• Trusted publishing identity abuse: Because the malicious packages were published using TanStack’s own OIDC identity rather than stolen static credentials, the packages carried npm’s trust indicators for verified publishers. Security controls that trust npm’s published identity were ineffective.
• Cloud credential exposure: AWS credentials, Kubernetes tokens, and Vault secrets accessible from CI environments represent direct paths to production infrastructure. A single compromised CI runner can expose credentials used across multiple production services.
• Cascading breach risk: The harvested credentials were used in subsequent attacks on Nx, GitHub, and Grafana Labs, demonstrating that the initial impact of a CI/CD supply chain attack can extend far beyond the directly affected organisation.
• Lock file bypass: The malicious versions were published to npm under normal version numbers that would satisfy standard semver ranges in existing lock files, meaning automated dependency updates could have pulled affected versions into projects that had not previously used those exact versions.

Affected Versions

Each of the 42 compromised packages received exactly two malicious versions. A selection of affected packages:

The full list of 42 affected packages is published in GHSA-g7cv-rxg3-hmpx and the TanStack postmortem. Any @tanstack/* package installed from npm between approximately 19:20–20:15 UTC on May 11, 2026 should be treated as potentially compromised. Malicious versions were unpublished within approximately 55 minutes of publication.

Remediation Steps

1. Identify exposure. Determine whether any development or CI environment installed a @tanstack/* package during approximately 19:20–20:15 UTC on May 11, 2026. Check npm lock files and CI build logs for the affected package versions.

2. Treat affected environments as fully compromised. Any environment that ran npm install and pulled an affected version executed the postinstall credential-sweeping script. Assume all credentials accessible from that environment were exfiltrated.

3. Rotate every secret accessible from the affected environment:

   • AWS IAM credentials (access keys and session tokens)
   • Kubernetes service account tokens and kubeconfig credentials
   • GitHub personal access tokens and fine-grained tokens
   • HashiCorp Vault tokens
   • npm publish tokens
   • SSH private keys used from the environment
   • Any .env-stored secrets

4. Re-image affected CI runners rather than rotating credentials in place — a post-installation backdoor could have been established.

5. Update to clean versions. Any current @tanstack/* package version after May 12, 2026 is safe.

6. Harden GitHub Actions workflows:

   • Remove pull_request_target triggers from workflows that use secrets or OIDC tokens; use pull_request (which does not carry base repo permissions from forks)
   • Scope cache keys to prevent cross-context poisoning
   • Apply permissions: contents: read minimum-privilege settings to workflow jobs
   • Use harden-runner (StepSecurity) or equivalent runtime monitoring for Actions runners

Detection Guidance

Check for affected package versions in lock files:

# In any project directory
grep -r "@tanstack/" package-lock.json yarn.lock pnpm-lock.yaml | grep "1\.169\.[58]\|5\.64\.[58]"

Check npm install logs (CI environments):

# Look for compromised version installations in CI logs
grep -E "@tanstack/(react|vue|solid|angular)-(router|query)@(1\.169\.[58]|5\.64\.[58])" ci-build.log

Network IOCs:

• Outbound HTTPS POST requests from node or npm processes to non-standard endpoints during package installation
• DNS queries to attacker infrastructure from CI runner IPs — specific IOC domains are published in the TanStack postmortem advisory

AWS CloudTrail: If AWS credentials were accessible from an affected environment, review CloudTrail for API calls made with access keys that were present in the environment during and after May 11, 2026.

GitHub audit log: Review your organisation’s GitHub audit log for token creation, repository access, or webhook modifications using tokens that were present in affected CI environments.

Endpoint detection:

• Processes running postinstall scripts that spawn network connections
• Node.js processes reading from ~/.kube/config, ~/.aws/credentials, or SSH key directories outside normal development tools

Timeline

References

• NVD — CVE-2026-45321
• CISA KEV — CVE-2026-45321
• MITRE CVE — CVE-2026-45321