📊 Full opportunity report: Three Public Vulnerabilities. Chained. on ThorstenMeyerAI.com — validation score, market gap, and execution plan.
TL;DR
On May 11, 2026, attackers exploited a chain of three publicly documented vulnerabilities to compromise TanStack npm packages. The attack used known flaws in GitHub Actions and trust boundaries, revealing how public research can be weaponized rapidly. The incident underscores the need for faster defense deployment.
On May 11, 2026, attackers exploited a chain of three publicly documented vulnerabilities to compromise the TanStack npm packages, using trusted GitHub workflows to exfiltrate credentials without theft of tokens or workflow compromise. The attack highlights how publicly available research can be weaponized faster than defenders can deploy mitigations, raising urgent concerns about supply-chain security.
The attack involved the publication of 84 malicious package versions across 42 TanStack npm modules within six minutes, executed via GitHub Actions using an OIDC trusted-publisher binding. The attacker created a malicious fork, injected payloads through a crafted commit, and exploited three known vulnerabilities: the pull_request_target “Pwn Request” pattern, cache poisoning across trust boundaries, and OIDC token extraction from runner memory. These vulnerabilities, all publicly documented before 2026, were chained to breach trust boundaries without the need for stolen tokens or direct workflow compromise.
Each vulnerability played a crucial role: the pull_request_target pattern allowed code from forks to execute with base repository privileges; cache poisoning enabled malicious code to persist across trust boundaries; and OIDC token extraction allowed exfiltration of credentials in memory. The attack was orchestrated in a manner that no single vulnerability alone would have sufficed, illustrating a complex, multi-layered supply-chain breach. The incident occurred on the same day as the Google Threat Intelligence Group disclosed a zero-day built with AI, emphasizing the rapid weaponization of public research.
Three public vulnerabilities.
Chained.
The TanStack npm compromise of May 11, 2026 — published research recombined into working tradecraft, weaponized faster than defenders deploy mitigations.
84 malicious versions across 42 packages. Six-minute publish window. No npm tokens stolen. OIDC minted in memory and exfiltrated via Session Protocol. Three vulnerabilities chained — each documented in public research 12-24 months before the attack. Same date as the GTIG zero-day disclosure. The composition is the attack surface.
Each bridges the trust boundary the others assumed.
PR fork code crossing into base-repo cache. Base-repo cache crossing into release-workflow runtime. Release-workflow runtime crossing into npm registry write access. The composition only works because each vulnerability bridges the trust boundary the others assumed.
pull_request_target for fork PRs and checked out the fork’s PR-merge ref to run a build. Bypasses first-time-contributor approval gate. Author attempted trust split but missed that actions/cache@v5‘s post-job save is not gated by permissions:. Cache scope is per-repo, shared across triggers.Linux-pnpm-store-${hashFiles('**/pnpm-lock.yaml')} — exact match. actions/cache@v5 post-step saves poisoned store to that key. Restored entirely as designed when release.yml next runs on push to main.id-token: write for legitimate npm OIDC trusted publishing. Poisoned cache invokes attacker binaries: locate Runner.Worker via /proc/*/cmdline, dump memory via /proc//maps + /proc//mem , extract OIDC token, POST to registry.npmjs.org. Bypasses workflow’s Publish Packages step entirely.The attacker did not invent novel tradecraft. They recombined published research. Verbatim Python script — attribution comment preserved — from the March 2025 tj-actions disclosure. Every defensive research publication becomes attacker reference material within 12-24 months.
IoT Supply Chain Security Risk Analysis and Mitigation: Modeling, Computations, and Software Tools (SpringerBriefs in Computer Science)
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
May 10 17:16 fork. May 11 19:50 detection.
From the attacker creating a renamed fork (deliberately evading fork-list searches) through the cache poisoning phase, the detonation phase, and the rapid external detection by Ashish Kurmi at StepSecurity. The TanStack postmortem published the complete root cause analysis publicly within hours.
PHASE
65bf499d authored by fabricated identity claude (NOT real Anthropic Claude). [skip ci] prefix suppresses CI on push. Adds packages/history/vite_setup.mjs — ~30,000-line bundled JS payload.PREP
pull_request_target. No first-time-contributor approval — pull_request_target bypasses that gate. pr.yml blocked.TRIGGER
65bf499d on PR head. bundle-size.yml’s benchmark-pr job checks out refs/pull/7378/merge, runs pnpm install + pnpm nx run @benchmarks/bundle-size:build. Executes fork-controlled vite_setup.mjs.EXEC
Linux-pnpm-store-6f9233a50def742c09fde54f56553d6b449a535adf87d4083690539f49ae4da11 (1.1 GB) saved for TanStack/router, scoped to refs/heads/main. Keyed to match what release.yml will compute on next push.ACTIVE
b1c061af). Visible PR diff is 0-file no-op. PR closed and branch deleted in same minute. Cache poison persists. PR appears benign in retrospective review./proc/*/cmdline, dumps memory, extracts OIDC token, POSTs to registry.npmjs.org. Bypasses defined Publish Packages step entirely.EXEC
@tanstack/history@1.161.12 etc. Six minutes between the two publish waves. Workflow status: failure (tests broke; publish still happened).BLAST
DETECTION
COMPLETE
npm package vulnerability scanner
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
160+ packages. One worm. Same threat actor.
The TanStack compromise is one node in the broader Mini Shai-Hulud campaign by threat group TeamPCP — the same actor behind LiteLLM PyPI (March 2026), Bitwarden CLI npm, SAP CAP npm, and Lightning PyPI (April 30, 2026). Self-propagating worm pattern. First documented npm worm with valid SLSA Build Level 3 attestations.
May 2026 wave
weekly downloads
compromised May 12
fork → detection
registry.npmjs.org/-/v1/search?text=maintainer: → republish with same injection. Active operational campaign as of May 12, 2026.
DevOps with GitHub Actions: A Practical Guide to Building Secure, Scalable, and Production-Ready CI/CD Automation Pipelines
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
IOCs · copy-pasteable for hunting queries.
The TanStack postmortem published comprehensive IOCs. Defenders should hunt for these across their environments. The attacker forged a “claude” identity using claude@users.noreply.github.com — not the real Anthropic Claude Code GitHub App. This identity-confusion tactic deserves specific attention in git-log audits.
bun run tanstack_runner.js && exit 1 on install — payload runs, then optional dep “fails” gracefully.router_init.js (~2.3 MB, package root, not in files array). Also: tanstack_runner.js per Socket analysis.https://litter.catbox.moe/h8nc9u.js, https://litter.catbox.moe/7rrc6l.mjs. Secondary exfil via legitimate-looking GitHub GraphQL API traffic.git log --all --author=claude@users.noreply.github.com across all repos. Force-push revert if found.zblgg (id 127806521) · voicproducoes (id 269549300 · account created 2026-03-19 — fresh account, public repos named “A Mini Shai-Hulud has Appeared”). Attacker fork: github.com/zblgg/configuration (renamed). Workflow runs: 25613093674 · 25691781302.OIDC token security tools
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Installed it? Rotate. Maintain packages? Audit.
Three response tracks. If you installed an affected version on May 11: treat your host as compromised. If you maintain OSS with similar workflow patterns: audit pull_request_target immediately. If you consume the npm ecosystem at enterprise scale: deploy install-time monitoring and lockfile pinning.
- Rotate AWS, GCP, Azure, Kubernetes service-account tokens, Vault tokens, npm
~/.npmrc, GitHub tokens, SSH private keys - Review GitHub Actions runs after 2026-05-11T19:20Z for unexpected npm publish events
- Check outbound connections to
filev2.getsession.org·seed*.getsession.org - Check downstream propagation — if your packages were published during a CI run that installed compromised version, those may also be compromised
- Audit
~/.claude/+.vscode/tasks.json· removerouter_runtime.js,setup.mjs git log --all --author=claude@users.noreply.github.com· revert if found- Run
npm token list· revoke unrecognized tokens
- Audit pull_request_target workflows immediately · never check out fork-submitted code without explicit approval gates
- Pin third-party action refs to commit SHAs ·
actions/checkout@8e5e7e5ab8...not@v6 - Separate cache scopes for trusted vs untrusted contexts · explicit
restore-keysandkeypatterns - Consider moving from OIDC trusted publisher to short-lived classic tokens with manual review
- Add internal alerting on npm publishes · fire on any publish that doesn’t originate from expected workflow step
- Audit other repos for the same bundle-size.yml-style pattern
- Restrict
id-token: writeto only the publish step that needs it
- Deploy npm package monitoring at install time · Socket / StepSecurity / Snyk · Socket flagged TanStack in 6 minutes
- Lockfile-pinned dependencies don’t auto-pull new versions · only consumers installing during the publish window were affected
- Audit lockfiles for
github:URLoptionalDependencies· unusual for production deps, exact pattern used here - CI/CD secret rotation automation · 30-90 day schedule regardless of incident status
- Treat provenance attestations as one layer, not sole verification · Mini Shai-Hulud produces valid Build L3 attestations on malicious packages
- Establish IR playbooks for OSS supply-chain compromise scenarios
Three pieces of public security research. Twelve months between the latest and the attack. Zero novel attacker tradecraft. A competent maintainer team with 2FA and OIDC trusted publishing — compromised through a chain that no individual vulnerability in their stack would have enabled. The composition is the attack surface.
Implications of Public Research Exploitation in Supply Chains
This incident demonstrates that the most consequential supply-chain breaches in 2026 are no longer driven by novel exploits but by the rapid weaponization of publicly available security research. Attackers can chain multiple known vulnerabilities to bypass defenses faster than organizations can deploy mitigations, exposing systemic weaknesses in open-source and enterprise supply-chain security. The attack underscores the urgency for faster, more integrated defense strategies and highlights the need for continuous security updates aligned with public research disclosures.
Public Vulnerabilities Documented Before the Attack
Over the past year, three key vulnerabilities relevant to this attack were publicly documented: the pull_request_target “Pwn Request” pattern by GitHub Security Lab (2021), cache poisoning across trust boundaries by Adnan Khan (May 2024), and OIDC token extraction from GitHub Actions runners by StepSecurity (March 2025). Each was known in the security community well before the May 11 incident. The attack exploited the chain of these vulnerabilities, which together created a trust breach in the CI/CD pipeline, enabling malicious code execution and credential exfiltration without direct workflow compromise.
This sequence exemplifies how public research, when weaponized, can produce sophisticated attack tradecraft, illustrating the ‘research-to-tradecraft’ compression problem where defenses lag behind attacker innovations.
“The TanStack attack demonstrates how publicly documented vulnerabilities can be chained to produce highly effective supply-chain breaches, highlighting the need for faster mitigation deployment.”
— Thorsten Meyer, security researcher
Unconfirmed Aspects and Ongoing Investigations
While the chain of vulnerabilities is well-documented, specific details about the attacker’s full operational infrastructure, the exact exfiltration methods used beyond initial exfiltration, and whether additional vulnerabilities were exploited remain under investigation. The extent of potential secondary impacts on other packages or ecosystems is also not yet clear. The timeline of detection and response by the TanStack team is being analyzed for lessons learned.
Future Mitigation Strategies and Industry Response
Organizations using npm and similar ecosystems are expected to review and strengthen their CI/CD security practices, especially around trust boundaries and dependency management. Developers and maintainers are urged to implement stricter code review processes for pull requests from forks, adopt more rigorous dependency verification, and deploy faster patching workflows. Industry-wide, there will likely be increased emphasis on integrating security research into rapid defense deployment and on developing tools to detect chained vulnerabilities in real-time.
Further forensic analysis and sharing of attack details are anticipated to inform better mitigation strategies and to improve the security posture of open-source ecosystems against similar future threats.
Key Questions
How did the attacker exploit public vulnerabilities so quickly?
The attacker chained three publicly documented vulnerabilities—pull_request_target, cache poisoning, and OIDC token extraction—to breach trust boundaries without needing to steal tokens or directly compromise workflows. The known nature of these vulnerabilities allowed rapid weaponization.
What can open-source projects do to protect themselves?
Projects should enforce stricter code review policies, especially for pull requests from forks, implement dependency verification, and monitor for unusual activity in CI/CD pipelines. Faster deployment of mitigations for known vulnerabilities is critical.
Are other packages or ecosystems at similar risk?
Yes, given that the vulnerabilities exploited are publicly documented, any project using similar trust boundaries and CI/CD practices may be vulnerable. The ongoing Mini Shai-Hulud campaign indicates widespread exposure across multiple ecosystems.
Was the npm registry compromised directly?
No, the npm registry itself was not compromised. The attacker used the trusted publishing process via GitHub Actions to inject malicious code into packages, exploiting trust boundaries rather than registry security.
Source: ThorstenMeyerAI.com
