📊 Full opportunity report: Three Public Vulnerabilities. Chained. on ThorstenMeyerAI.com — validation score, market gap, and execution plan.
TL;DR
On May 11, 2026, attackers exploited a chain of three publicly documented vulnerabilities in TanStack npm packages, enabling a supply chain compromise. The attack leveraged known flaws, highlighting the pace at which public research becomes attacker tradecraft.
On May 11, 2026, attackers exploited a chain of three publicly documented vulnerabilities to compromise the TanStack npm packages, leading to the publication of 84 malicious versions in a six-minute window. This attack, which did not involve stolen tokens or a breach of the npm registry, underscores how publicly available research can be rapidly weaponized, outpacing defenders’ mitigation efforts. The incident highlights systemic security challenges in open-source supply chains.
The attack targeted TanStack, a popular open-source JavaScript library ecosystem, by creating a malicious fork and exploiting trust boundaries in GitHub Actions workflows. The attacker, identified as user zblgg, created a fork of TanStack/router on May 10, and inserted a malicious commit containing a large JavaScript payload. This commit was crafted to evade detection through renaming and fabricated identities.
On May 11, the attacker opened a pull request using the pull_request_target pattern, which triggered workflows that allowed the malicious code to execute in the base repository’s context. Through this process, the attacker minted an OIDC token in memory, exfiltrated credentials via the Session Protocol, and manipulated the release workflow to publish malicious npm versions. Crucially, no npm tokens were stolen, and the npm publish process itself was not compromised.
Forensic analysis identified three vulnerabilities that, when chained, enabled this attack: the pull_request_target ‘pwn request’ pattern, cache poisoning across fork-base trust boundaries, and OIDC token extraction from GitHub Actions runner memory. Each vulnerability was publicly documented before the attack, with research dating back from March 2025. The attack demonstrates how these known flaws can be combined to breach supply chain defenses.
Three public vulnerabilities.
Chained.
The TanStack npm compromise of May 11, 2026 — published research recombined into working tradecraft, weaponized faster than defenders deploy mitigations.
84 malicious versions across 42 packages. Six-minute publish window. No npm tokens stolen. OIDC minted in memory and exfiltrated via Session Protocol. Three vulnerabilities chained — each documented in public research 12-24 months before the attack. Same date as the GTIG zero-day disclosure. The composition is the attack surface.
Each bridges the trust boundary the others assumed.
PR fork code crossing into base-repo cache. Base-repo cache crossing into release-workflow runtime. Release-workflow runtime crossing into npm registry write access. The composition only works because each vulnerability bridges the trust boundary the others assumed.
pull_request_target for fork PRs and checked out the fork’s PR-merge ref to run a build. Bypasses first-time-contributor approval gate. Author attempted trust split but missed that actions/cache@v5‘s post-job save is not gated by permissions:. Cache scope is per-repo, shared across triggers.Linux-pnpm-store-${hashFiles('**/pnpm-lock.yaml')} — exact match. actions/cache@v5 post-step saves poisoned store to that key. Restored entirely as designed when release.yml next runs on push to main.id-token: write for legitimate npm OIDC trusted publishing. Poisoned cache invokes attacker binaries: locate Runner.Worker via /proc/*/cmdline, dump memory via /proc//maps + /proc//mem , extract OIDC token, POST to registry.npmjs.org. Bypasses workflow’s Publish Packages step entirely.The attacker did not invent novel tradecraft. They recombined published research. Verbatim Python script — attribution comment preserved — from the March 2025 tj-actions disclosure. Every defensive research publication becomes attacker reference material within 12-24 months.
Software Supply Chain Defense: Securing Build Environments, Toolchains, and CI/CD Infrastructure Against Advanced Threats
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
May 10 17:16 fork. May 11 19:50 detection.
From the attacker creating a renamed fork (deliberately evading fork-list searches) through the cache poisoning phase, the detonation phase, and the rapid external detection by Ashish Kurmi at StepSecurity. The TanStack postmortem published the complete root cause analysis publicly within hours.
PHASE
65bf499d authored by fabricated identity claude (NOT real Anthropic Claude). [skip ci] prefix suppresses CI on push. Adds packages/history/vite_setup.mjs — ~30,000-line bundled JS payload.PREP
pull_request_target. No first-time-contributor approval — pull_request_target bypasses that gate. pr.yml blocked.TRIGGER
65bf499d on PR head. bundle-size.yml’s benchmark-pr job checks out refs/pull/7378/merge, runs pnpm install + pnpm nx run @benchmarks/bundle-size:build. Executes fork-controlled vite_setup.mjs.EXEC
Linux-pnpm-store-6f9233a50def742c09fde54f56553d6b449a535adf87d4083690539f49ae4da11 (1.1 GB) saved for TanStack/router, scoped to refs/heads/main. Keyed to match what release.yml will compute on next push.ACTIVE
b1c061af). Visible PR diff is 0-file no-op. PR closed and branch deleted in same minute. Cache poison persists. PR appears benign in retrospective review./proc/*/cmdline, dumps memory, extracts OIDC token, POSTs to registry.npmjs.org. Bypasses defined Publish Packages step entirely.EXEC
@tanstack/history@1.161.12 etc. Six minutes between the two publish waves. Workflow status: failure (tests broke; publish still happened).BLAST
DETECTION
COMPLETE
JavaScript Security Engineering: Offensive Testing, Secure Coding, and Web App Defense (Cybersecurity Coding Mastery Series: High-Performance Security Tools, Automation, and Detection Engineering)
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
160+ packages. One worm. Same threat actor.
The TanStack compromise is one node in the broader Mini Shai-Hulud campaign by threat group TeamPCP — the same actor behind LiteLLM PyPI (March 2026), Bitwarden CLI npm, SAP CAP npm, and Lightning PyPI (April 30, 2026). Self-propagating worm pattern. First documented npm worm with valid SLSA Build Level 3 attestations.
May 2026 wave
weekly downloads
compromised May 12
fork → detection
registry.npmjs.org/-/v1/search?text=maintainer: → republish with same injection. Active operational campaign as of May 12, 2026.
DevOps with GitHub Actions: A Practical Guide to Building Secure, Scalable, and Production-Ready CI/CD Automation Pipelines
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
IOCs · copy-pasteable for hunting queries.
The TanStack postmortem published comprehensive IOCs. Defenders should hunt for these across their environments. The attacker forged a “claude” identity using claude@users.noreply.github.com — not the real Anthropic Claude Code GitHub App. This identity-confusion tactic deserves specific attention in git-log audits.
bun run tanstack_runner.js && exit 1 on install — payload runs, then optional dep “fails” gracefully.router_init.js (~2.3 MB, package root, not in files array). Also: tanstack_runner.js per Socket analysis.https://litter.catbox.moe/h8nc9u.js, https://litter.catbox.moe/7rrc6l.mjs. Secondary exfil via legitimate-looking GitHub GraphQL API traffic.git log --all --author=claude@users.noreply.github.com across all repos. Force-push revert if found.zblgg (id 127806521) · voicproducoes (id 269549300 · account created 2026-03-19 — fresh account, public repos named “A Mini Shai-Hulud has Appeared”). Attacker fork: github.com/zblgg/configuration (renamed). Workflow runs: 25613093674 · 25691781302.npm package vulnerability scanner
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Installed it? Rotate. Maintain packages? Audit.
Three response tracks. If you installed an affected version on May 11: treat your host as compromised. If you maintain OSS with similar workflow patterns: audit pull_request_target immediately. If you consume the npm ecosystem at enterprise scale: deploy install-time monitoring and lockfile pinning.
- Rotate AWS, GCP, Azure, Kubernetes service-account tokens, Vault tokens, npm
~/.npmrc, GitHub tokens, SSH private keys - Review GitHub Actions runs after 2026-05-11T19:20Z for unexpected npm publish events
- Check outbound connections to
filev2.getsession.org·seed*.getsession.org - Check downstream propagation — if your packages were published during a CI run that installed compromised version, those may also be compromised
- Audit
~/.claude/+.vscode/tasks.json· removerouter_runtime.js,setup.mjs git log --all --author=claude@users.noreply.github.com· revert if found- Run
npm token list· revoke unrecognized tokens
- Audit pull_request_target workflows immediately · never check out fork-submitted code without explicit approval gates
- Pin third-party action refs to commit SHAs ·
actions/checkout@8e5e7e5ab8...not@v6 - Separate cache scopes for trusted vs untrusted contexts · explicit
restore-keysandkeypatterns - Consider moving from OIDC trusted publisher to short-lived classic tokens with manual review
- Add internal alerting on npm publishes · fire on any publish that doesn’t originate from expected workflow step
- Audit other repos for the same bundle-size.yml-style pattern
- Restrict
id-token: writeto only the publish step that needs it
- Deploy npm package monitoring at install time · Socket / StepSecurity / Snyk · Socket flagged TanStack in 6 minutes
- Lockfile-pinned dependencies don’t auto-pull new versions · only consumers installing during the publish window were affected
- Audit lockfiles for
github:URLoptionalDependencies· unusual for production deps, exact pattern used here - CI/CD secret rotation automation · 30-90 day schedule regardless of incident status
- Treat provenance attestations as one layer, not sole verification · Mini Shai-Hulud produces valid Build L3 attestations on malicious packages
- Establish IR playbooks for OSS supply-chain compromise scenarios
Three pieces of public security research. Twelve months between the latest and the attack. Zero novel attacker tradecraft. A competent maintainer team with 2FA and OIDC trusted publishing — compromised through a chain that no individual vulnerability in their stack would have enabled. The composition is the attack surface.
Implications of Public Research in Supply Chain Attacks
This incident exemplifies how publicly available security research can be rapidly weaponized by attackers, creating a significant challenge for defenders. The attack leveraged three known vulnerabilities, each documented in academic or industry research, which together enabled a complex supply chain compromise without the need for zero-day exploits or stolen credentials. It underscores the importance of proactive mitigation strategies and the limitations of relying solely on patching known issues.
For open-source maintainers and enterprise users, the attack highlights the need for rigorous review of trust boundaries, workflow configurations, and supply chain controls. As attack tradecraft increasingly compresses from research to execution, organizations must adapt their security postures to address the evolving threat landscape.
Historical and Technical Background of the Exploited Vulnerabilities
The May 2026 attack on TanStack is part of a broader wave of supply chain compromises, including over 160 packages affected in the ongoing Mini Shai-Hulud campaign. The specific vulnerabilities exploited were all publicly documented prior to the incident: the pull_request_target pattern (GitHub Security Lab, 2019), cache poisoning across trust boundaries (Adnan Khan, 2024), and OIDC token extraction from runner memory (StepSecurity, 2025).
These vulnerabilities represent systemic issues in CI/CD workflows and trust models within open-source ecosystems. The attack timeline began with the creation of a malicious fork on May 10, followed by the insertion of a payload, and culminated in the rapid publication of malicious package versions on May 11. The attack’s success was enabled by chaining these known flaws, each necessary but not sufficient alone, to breach the supply chain.
This event illustrates the danger of research-to-tradecraft compression, where attacker capabilities expand as publicly available research is weaponized faster than defenses can adapt.
“The TanStack incident demonstrates how publicly documented vulnerabilities can be combined into a sophisticated attack chain, outpacing defensive response times.”
— Thorsten Meyer, researcher
Remaining Questions About the Attack Chain and Mitigations
While the forensic analysis has identified the chain of vulnerabilities exploited, details about the attacker’s full scope, potential additional payloads, and long-term impacts remain unclear. It is also uncertain how quickly mitigations can be deployed across the ecosystem, given the rapid pace of attack weaponization of public research.
Furthermore, the extent to which other open-source projects are vulnerable to similar chaining remains to be assessed, and whether additional undisclosed vulnerabilities played a role is not yet confirmed.
Steps for Defense and Ecosystem-Wide Mitigation
Organizations and open-source maintainers must review their CI/CD workflows, especially trust boundaries and workflow permissions, to prevent similar chaining exploits. Immediate steps include disabling or restricting the use of pull_request_target patterns, enhancing code review processes for forks, and applying stricter controls on workflow triggers.
Security researchers and platform providers are likely to release updated guidance and patches to address these vulnerabilities. Monitoring for further exploitation attempts and conducting comprehensive audits of trust boundaries will be critical in the coming weeks.
The incident underscores the urgency of integrating security best practices into development pipelines and fostering a security-aware culture among open-source maintainers and enterprise teams.
Key Questions
What are the main vulnerabilities exploited in the TanStack attack?
The attack exploited three publicly documented vulnerabilities: the pull_request_target ‘pwn request’ pattern, cache poisoning across fork-base trust boundaries, and OIDC token extraction from GitHub Actions runner memory. These were chained together to breach the supply chain.
Did the attack involve stealing npm tokens or compromising the npm registry?
No, the attacker did not steal npm tokens nor did they compromise the npm registry. Instead, they minted an OIDC token in memory and exfiltrated credentials via the Session Protocol, then used workflow permissions to publish malicious versions.
How quickly did defenders respond to this attack?
Forensic analysis and detection occurred within approximately 28 hours of the initial malicious fork creation. However, the rapid weaponization of public research means mitigations lag behind attacker capabilities.
What can open-source projects do to prevent similar attacks?
Projects should review and restrict trust boundaries in CI/CD workflows, avoid risky patterns like pull_request_target, implement stricter code review for forks, and monitor for suspicious activity. Upgrading security controls and awareness is essential.
Source: ThorstenMeyerAI.com
