TanStack Supply Chain Attack: 160 npm Packages Expose Developer Credentials to Dark Web

The TanStack npm supply chain attack operated through a four-stage chain that exploited a known GitHub Actions weakness called the "Pwn Request" pattern, allowing attackers to cross the trust boundary between untrusted fork pull requests and production release pipelines.

Stage 1, Fork and payload staging. The attacker (GitHub account voicproducoes, ID 269549300, created March 2026) forked the TanStack/router repository on May 10 and committed two files: tanstack_runner.js, a 2.3 MB obfuscated JavaScript payload, and a modified package.json that referenced the malicious fork as an optionalDependency. Three obfuscation layers protected the payload: 11,516 custom base64 strings, a Fisher-Yates substitution cipher, and AES-256-GCM encrypted secondary scripts requiring the Bun runtime. The package.json prepare lifecycle hook triggered payload execution on any npm install.

Stage 2, Cache poisoning. On May 11 at approximately 10:49 UTC, the attacker opened PR #7378 against the official TanStack/router repository, triggering the bundle-size.yml workflow. That workflow used the pull_request_target pattern, a GitHub Actions antipattern that executes fork PR code with repository-level permissions. The malicious code wrote a poisoned pnpm store into the Actions cache under a key that legitimate production release workflows would later restore.

Stage 3, OIDC token theft and worm publishing. At 19:20 UTC, a production release workflow restored the poisoned cache. The payload located the GitHub Actions Runner.Worker process via /proc/*/cmdline, dumped its memory using /proc/{PID}/mem, and extracted the OIDC token. The payload exchanged that token for per-package npm publish credentials and published 84 malicious versions across 42 @tanstack packages in 6 minutes. It then enumerated every package controlled by any maintainer whose npm token was recovered and republished each, the worm mechanism that spread the compromise to 160+ packages across UiPath, Mistral AI, OpenSearch, and others.

Stage 4, Developer machine infection. Any npm install that pulled the affected @tanstack packages executed the payload locally, harvesting credentials from 100+ file paths and exfiltrating them to filev2.getsession.org under RSA-4096-OAEP wrapped AES-256-GCM encryption.

Researcher ashishkurmi disclosed the attack via GitHub issue #7383 at 19:46 UTC, 26 minutes after the first malicious publish, by which time the worm had already spread beyond the @tanstack namespace.

TeamPCP is a financially motivated cybercrime group responsible for at least two documented "Mini Shai-Hulud" supply chain worm campaigns against the npm and PyPI ecosystems. The group takes its internal codename from Frank Herbert's Dune universe: attacker Git branch names documented in this campaign include fremen, sandworm, harkonnen, atreides, and melange, establishing operational continuity between attacks and a preference for distinctive tradecraft.

Attribution is based on overlapping C2 infrastructure, the attacker GitHub account voicproducoes (ID 269549300, email voicproducoes@gmail.com, created March 2026), and matching payload signatures between the May 2026 attack and a prior Mini Shai-Hulud campaign. No formal government attribution exists. TeamPCP operates as a financially motivated extortion actor rather than a state-sponsored espionage unit.

TeamPCP's business model follows three steps: compromise via supply chain, exfiltrate via privacy-service CDN to evade detection, then issue extortion demands. On May 15, a TeamPCP affiliate operating as "CoinbaseCartel" listed Grafana Labs on a dark web extortion site. On May 16, Grafana received a ransom demand and refused to pay, noting payment provides no guarantee of data destruction. TeamPCP separately listed GitHub's internal repositories on a cybercrime forum with a minimum asking price of $50,000.

Three TeamPCP tradecraft patterns are particularly notable for defenders. The group routes exfiltration through filev2.getsession.org, the Session Protocol's legitimate CDN, to defeat threat intelligence blocklists. It commits stolen data as GitHub GraphQL dead-drops with commits falsely attributed to claude@users.noreply.github.com to blend into normal developer activity. It also embeds a destructive tripwire: npm tokens found on infected machines receive the description IfYouRevokeThisTokenItWillWipeTheComputerOfTheOwner, designed to trigger a disk wipe if a security team revokes the token without first isolating the machine.

Similar financially motivated extortion operations targeting developer platforms appeared in the ShinyHunters group's 30 million Canvas LMS breach, where stolen credentials from a developer-facing environment immediately fueled large-scale data extortion.

The TanStack supply chain payload harvested credentials from 100+ specific file paths on infected developer machines and CI/CD runners, covering every major cloud platform, developer tool, and several cryptocurrency wallets.

Cloud infrastructure credentials carry the highest impact. The payload queried the AWS EC2 Instance Metadata Service at 169.254.169.254 via IMDSv2 to enumerate IAM roles and fetch temporary access credentials with the full permission scope of the attached role, often including read access to S3 buckets, DynamoDB tables, and Secrets Manager entries. GCP service account JSON files were read from default locations. Kubernetes service-account tokens and HashiCorp Vault tokens at 127.0.0.1:8200 were also targeted.

Developer platform credentials targeted include npm registry tokens from ~/.npmrc (prioritizing tokens with bypass_2fa: true), GitHub personal access tokens from the gh CLI and .git-credentials, SSH private keys from ~/.ssh/id_rsa and ~/.ssh/id_ed25519, Docker Hub credentials from ~/.docker/config.json, and PyPI publish tokens from ~/.pypirc.

In-memory secrets represent the stealthiest theft category. The payload scraped GitHub Actions Runner.Worker process memory via /proc/{PID}/mem, extracting all in-memory secret objects matching the structure {"value":"...","isSecret":true}. This technique bypasses GitHub's secret masking entirely, secrets never referenced in YAML were exposed. Any secret value injected into a GitHub Actions environment during a compromised workflow run must be treated as exfiltrated.

Persistence mechanisms extended credential theft beyond the initial infection window. On macOS, the payload installed a LaunchAgent at ~/Library/LaunchAgents/com.user.gh-token-monitor.plist that re-exfiltrates GitHub tokens after every reboot. On Linux, a systemd user service at ~/.config/systemd/user/gh-token-monitor.service provides equivalent persistence. Both survive software updates and typically evade endpoint detection focused on process-level behavioral signals.

Security teams should not rely on endpoint detection as the primary indicator. Any machine that ran npm install with @tanstack router packages on May 11 should be treated as fully compromised pending a complete credential rotation and persistence artifact sweep.

Five organizations confirmed or disclosed unauthorized access linked to this campaign as of May 21, 2026.

GitHub disclosed today that approximately 3,800 internal repositories were accessed by TeamPCP. The breach vector was Nx Console 18.95.0, a malicious VS Code extension version published using stolen credentials from the TanStack campaign. The extension was available on VS Code Marketplace for 18 minutes and OpenVSX for 36 minutes, recording 28 and 41 downloads respectively. An estimated 6,000 additional activations occurred via the auto-update mechanism after public disclosure. GitHub rotated critical secrets between Monday and Tuesday and stated no customer data in systems outside the accessed repositories was exfiltrated.

Grafana Labs confirmed on May 19 that a single GitHub workflow token not rotated after the initial TanStack incident gave attackers access to source code, private repositories, and internal operational information. CoinbaseCartel, a TeamPCP affiliate, listed Grafana on a dark web extortion site on May 15. Grafana received a ransom demand on May 16 and refused to pay, explicitly noting that payment provides no guarantee of data destruction and increases the probability of future targeting.

Mistral AI had its @mistralai/mistralai npm package versions 2.2.3 and 2.2.4 compromised by the self-propagating worm after a maintainer token was obtained from an infected machine. Any developer or CI/CD pipeline that installed those versions during the attack window should rotate credentials.

UiPath had 60+ packages in the @uipath/ npm namespace compromised by the worm after maintainer tokens were obtained from affected machines.

Two OpenAI employees had personal developer credentials compromised via the Nx Console extension, according to security researchers tracking the campaign.

The full scope of affected organizations remains under investigation. Organizations using any of the 160+ compromised packages in CI/CD pipelines should begin incident response immediately. Check the DAEMON Tools supply chain compromise documented in the May 11 weekly roundup for parallel attack patterns that attackers are layering against developer toolchains this month.

The indicators below span all four attack stages: C2 infrastructure, exfiltration channels, malicious file hashes, and persistence artifacts. Search all indicators before beginning credential rotation, specifically, check for the npm token tripwire descriptor before revoking any npm tokens from potentially infected machines.

Execute these steps in the order listed. Isolate any machine where you find the npm token tripwire before revoking credentials from that machine.

The TanStack npm supply chain attack matters beyond its immediate scope because it demonstrated that a single compromised OIDC token from one organization's CI/CD pipeline can propagate into 160+ unrelated packages within 6 minutes, bypassing SLSA supply chain security attestations that the broader industry has spent years building. The TanStack postmortem explicitly acknowledged this: SLSA provenance confirms which pipeline produced the artifact, not whether that pipeline was behaving as intended.

The @tanstack/react-router package reaches 12 million developers weekly. Even if only a fraction of installations during the 22-minute attack window occurred in CI/CD environments with significant cloud credentials attached, the downstream scope includes thousands of potentially compromised AWS, GCP, and Kubernetes environments. Security teams that have not audited their npm install logs from May 11 are working against attackers who have had 10 days to weaponize stolen credentials against cloud infrastructure.

The dark web sale of GitHub's 3,800 internal repositories amplifies the risk beyond initial credential theft. Source code repositories hold hardcoded API keys, internal service URLs, proprietary security controls, and architectural documentation. Attackers purchasing that access gain intelligence for highly targeted follow-on attacks against GitHub's supply chain customers, every organization using GitHub Actions, GitHub Packages, or Dependabot is a downstream target of what was accessed.

Three factors make this attack particularly difficult to contain. The payload used legitimate privacy infrastructure for exfiltration, making network-level detection unreliable against standard threat intel blocklists. It planted persistence that survives reboots and updates. It embedded a destructive tripwire designed to deter rapid credential revocation. Organizations must assume compromise, isolate affected machines, and rotate credentials methodically.

Developer security teams should evaluate whether their GitHub Actions workflows use the pull_request_target pattern against fork pull requests. StepSecurity's Harden-Runner and Socket Security both offer workflow auditing that flags this antipattern before it becomes an exploitation path. Pinning all CI/CD tool versions and using OpenID Connect for short-lived cloud credentials eliminates the long-lived token targets that made this campaign so productive for TeamPCP.