📊 Full opportunity report: Three Public Vulnerabilities. Chained. on ThorstenMeyerAI.com — validation score, market gap, and execution plan.
TL;DR
In May 2026, attackers exploited a chain of three publicly documented vulnerabilities to compromise TanStack npm packages. The attack underscores how public research can be weaponized faster than defenses deploy mitigations, raising concerns about supply chain security.
On May 11, 2026, attackers exploited a chain of three publicly documented vulnerabilities to publish 84 malicious versions of TanStack npm packages within six minutes, bypassing existing security measures. This incident, involving the TanStack maintainer team, highlights how publicly available research can be weaponized rapidly, posing significant risks to software supply chains.
The attack was carried out by creating a malicious fork of TanStack/router on GitHub, then injecting payloads via a crafted commit. The attacker used the pull_request_target pattern, a known vulnerability documented by GitHub Security Lab, to execute malicious code within the trusted base repository. The attacker then leveraged cache poisoning across the fork-to-base trust boundary, a vulnerability detailed by Adnan Khan in May 2024, to manipulate the build process. Finally, the attacker exfiltrated an OIDC token from the GitHub Actions runtime, a technique documented by StepSecurity in March 2025, to authenticate and publish malicious packages to npm. Each vulnerability was known and publicly documented for at least 12 months prior to the attack, but the chain was only effective when combined.
Despite the TanStack team’s security measures—including 2FA and OIDC trusted publishing—the attack succeeded because the vulnerabilities exploited different trust boundaries, and each was necessary for the compromise. The incident is part of a broader wave of supply chain attacks in May 2026, which affected over 160 packages across multiple organizations, including Mistral AI and UiPath.
Three public vulnerabilities.
Chained.
The TanStack npm compromise of May 11, 2026 — published research recombined into working tradecraft, weaponized faster than defenders deploy mitigations.
84 malicious versions across 42 packages. Six-minute publish window. No npm tokens stolen. OIDC minted in memory and exfiltrated via Session Protocol. Three vulnerabilities chained — each documented in public research 12-24 months before the attack. Same date as the GTIG zero-day disclosure. The composition is the attack surface.
Each bridges the trust boundary the others assumed.
PR fork code crossing into base-repo cache. Base-repo cache crossing into release-workflow runtime. Release-workflow runtime crossing into npm registry write access. The composition only works because each vulnerability bridges the trust boundary the others assumed.
pull_request_target for fork PRs and checked out the fork’s PR-merge ref to run a build. Bypasses first-time-contributor approval gate. Author attempted trust split but missed that actions/cache@v5‘s post-job save is not gated by permissions:. Cache scope is per-repo, shared across triggers.Linux-pnpm-store-${hashFiles('**/pnpm-lock.yaml')} — exact match. actions/cache@v5 post-step saves poisoned store to that key. Restored entirely as designed when release.yml next runs on push to main.id-token: write for legitimate npm OIDC trusted publishing. Poisoned cache invokes attacker binaries: locate Runner.Worker via /proc/*/cmdline, dump memory via /proc//maps + /proc//mem , extract OIDC token, POST to registry.npmjs.org. Bypasses workflow’s Publish Packages step entirely.The attacker did not invent novel tradecraft. They recombined published research. Verbatim Python script — attribution comment preserved — from the March 2025 tj-actions disclosure. Every defensive research publication becomes attacker reference material within 12-24 months.
IoT Supply Chain Security Risk Analysis and Mitigation: Modeling, Computations, and Software Tools (SpringerBriefs in Computer Science)
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
May 10 17:16 fork. May 11 19:50 detection.
From the attacker creating a renamed fork (deliberately evading fork-list searches) through the cache poisoning phase, the detonation phase, and the rapid external detection by Ashish Kurmi at StepSecurity. The TanStack postmortem published the complete root cause analysis publicly within hours.
PHASE
65bf499d authored by fabricated identity claude (NOT real Anthropic Claude). [skip ci] prefix suppresses CI on push. Adds packages/history/vite_setup.mjs — ~30,000-line bundled JS payload.PREP
pull_request_target. No first-time-contributor approval — pull_request_target bypasses that gate. pr.yml blocked.TRIGGER
65bf499d on PR head. bundle-size.yml’s benchmark-pr job checks out refs/pull/7378/merge, runs pnpm install + pnpm nx run @benchmarks/bundle-size:build. Executes fork-controlled vite_setup.mjs.EXEC
Linux-pnpm-store-6f9233a50def742c09fde54f56553d6b449a535adf87d4083690539f49ae4da11 (1.1 GB) saved for TanStack/router, scoped to refs/heads/main. Keyed to match what release.yml will compute on next push.ACTIVE
b1c061af). Visible PR diff is 0-file no-op. PR closed and branch deleted in same minute. Cache poison persists. PR appears benign in retrospective review./proc/*/cmdline, dumps memory, extracts OIDC token, POSTs to registry.npmjs.org. Bypasses defined Publish Packages step entirely.EXEC
@tanstack/history@1.161.12 etc. Six minutes between the two publish waves. Workflow status: failure (tests broke; publish still happened).BLAST
DETECTION
COMPLETE
160+ packages. One worm. Same threat actor.
The TanStack compromise is one node in the broader Mini Shai-Hulud campaign by threat group TeamPCP — the same actor behind LiteLLM PyPI (March 2026), Bitwarden CLI npm, SAP CAP npm, and Lightning PyPI (April 30, 2026). Self-propagating worm pattern. First documented npm worm with valid SLSA Build Level 3 attestations.
May 2026 wave
weekly downloads
compromised May 12
fork → detection
registry.npmjs.org/-/v1/search?text=maintainer: → republish with same injection. Active operational campaign as of May 12, 2026.IOCs · copy-pasteable for hunting queries.
The TanStack postmortem published comprehensive IOCs. Defenders should hunt for these across their environments. The attacker forged a “claude” identity using claude@users.noreply.github.com — not the real Anthropic Claude Code GitHub App. This identity-confusion tactic deserves specific attention in git-log audits.
bun run tanstack_runner.js && exit 1 on install — payload runs, then optional dep “fails” gracefully.router_init.js (~2.3 MB, package root, not in files array). Also: tanstack_runner.js per Socket analysis.https://litter.catbox.moe/h8nc9u.js, https://litter.catbox.moe/7rrc6l.mjs. Secondary exfil via legitimate-looking GitHub GraphQL API traffic.git log --all --author=claude@users.noreply.github.com across all repos. Force-push revert if found.zblgg (id 127806521) · voicproducoes (id 269549300 · account created 2026-03-19 — fresh account, public repos named “A Mini Shai-Hulud has Appeared”). Attacker fork: github.com/zblgg/configuration (renamed). Workflow runs: 25613093674 · 25691781302.Installed it? Rotate. Maintain packages? Audit.
Three response tracks. If you installed an affected version on May 11: treat your host as compromised. If you maintain OSS with similar workflow patterns: audit pull_request_target immediately. If you consume the npm ecosystem at enterprise scale: deploy install-time monitoring and lockfile pinning.
- Rotate AWS, GCP, Azure, Kubernetes service-account tokens, Vault tokens, npm
~/.npmrc, GitHub tokens, SSH private keys - Review GitHub Actions runs after 2026-05-11T19:20Z for unexpected npm publish events
- Check outbound connections to
filev2.getsession.org·seed*.getsession.org - Check downstream propagation — if your packages were published during a CI run that installed compromised version, those may also be compromised
- Audit
~/.claude/+.vscode/tasks.json· removerouter_runtime.js,setup.mjs git log --all --author=claude@users.noreply.github.com· revert if found- Run
npm token list· revoke unrecognized tokens
- Audit pull_request_target workflows immediately · never check out fork-submitted code without explicit approval gates
- Pin third-party action refs to commit SHAs ·
actions/checkout@8e5e7e5ab8...not@v6 - Separate cache scopes for trusted vs untrusted contexts · explicit
restore-keysandkeypatterns - Consider moving from OIDC trusted publisher to short-lived classic tokens with manual review
- Add internal alerting on npm publishes · fire on any publish that doesn’t originate from expected workflow step
- Audit other repos for the same bundle-size.yml-style pattern
- Restrict
id-token: writeto only the publish step that needs it
- Deploy npm package monitoring at install time · Socket / StepSecurity / Snyk · Socket flagged TanStack in 6 minutes
- Lockfile-pinned dependencies don’t auto-pull new versions · only consumers installing during the publish window were affected
- Audit lockfiles for
github:URLoptionalDependencies· unusual for production deps, exact pattern used here - CI/CD secret rotation automation · 30-90 day schedule regardless of incident status
- Treat provenance attestations as one layer, not sole verification · Mini Shai-Hulud produces valid Build L3 attestations on malicious packages
- Establish IR playbooks for OSS supply-chain compromise scenarios
Three pieces of public security research. Twelve months between the latest and the attack. Zero novel attacker tradecraft. A competent maintainer team with 2FA and OIDC trusted publishing — compromised through a chain that no individual vulnerability in their stack would have enabled. The composition is the attack surface.
Implications of Publicly Documented Vulnerabilities
This incident demonstrates that publicly available security research can be weaponized in real-world attacks faster than organizations can deploy mitigations. The chain of vulnerabilities underscores the need for proactive defense strategies, especially in open-source ecosystems where trust boundaries are complex and often exploited. It also highlights the importance of continuous monitoring and rapid response capabilities to detect and contain such sophisticated supply chain attacks before widespread damage occurs.
Pre-Existing Research and Supply Chain Risks
Over the past year, security researchers have documented multiple vulnerabilities related to GitHub Actions and npm package trust boundaries. In May 2024, Adnan Khan detailed cache poisoning risks across fork and base repositories. In March 2025, StepSecurity revealed how OIDC tokens can be extracted from GitHub Actions runners. These findings, combined with the May 2026 disclosure of the AI-built zero-day by Google Threat Intelligence Group, illustrate a growing landscape of attack techniques that can be combined into sophisticated chain exploits. The TanStack incident is a clear example of how attackers leverage this research in rapid, automated campaigns, exploiting the gap between research publication and mitigation deployment.
“The TanStack attack exemplifies how publicly documented vulnerabilities can be chained together to execute large-scale supply chain compromises in real time.”
— Thorsten Meyer, security researcher
Remaining Uncertainties in Attack Scope
It is not yet clear how many other projects might have been similarly compromised using this attack chain, or whether additional vulnerabilities were exploited beyond those publicly documented. The full extent of the malicious payloads and the precise timeline of attacker operations are still under investigation. Furthermore, the effectiveness of current mitigations and whether any other organizations have been targeted remains uncertain.
Next Steps for Defense and Investigation
Security teams will focus on analyzing the full scope of the breach, patching vulnerabilities, and improving detection mechanisms for similar attack chains. GitHub and npm are expected to enhance their security controls, including stricter review of pull requests and better monitoring of package publishing activities. The incident underscores the need for proactive security measures in open-source ecosystems, and organizations should review their supply chain defenses accordingly. Ongoing investigations aim to determine if additional attacks have occurred and how to prevent future exploitation of publicly documented vulnerabilities.
Key Questions
How did the attacker bypass security measures in the TanStack attack?
The attacker exploited a chain of three known vulnerabilities—pull request targeting, cache poisoning, and OIDC token extraction—each of which alone was insufficient but together enabled the breach.
What is the significance of this incident for open-source security?
It shows that publicly documented vulnerabilities can be rapidly weaponized, emphasizing the need for proactive mitigation, continuous monitoring, and faster deployment of security patches in open-source projects.
Are other projects at risk from similar attack chains?
While the full scope is still under investigation, the vulnerabilities exploited are common and well-known, suggesting that other projects could be vulnerable if similar chains are exploited.
What can organizations do to protect themselves from such attacks?
Organizations should review their trust boundaries, implement stricter code review processes, monitor for suspicious activity, and stay updated on security advisories related to their development tools and dependencies.
Source: ThorstenMeyerAI.com
