The GitHub Actions Compromise Chain#

TanStack’s postmortem attributes the initial access to a combination of three GitHub Actions misconfiguration patterns:

1. pull_request_target - This workflow trigger makes the base repository’s workflow code available to pull request authors. When combined with cache poisoning, it allows an attacker controlling a fork to influence trusted pipeline behavior.
2. GitHub Actions cache poisoning - Attackers injected malicious content into the shared workflow cache, which was later loaded by the base repository’s CI pipeline.
3. OIDC token memory extraction - After attacker controlled code ran in the workflow, it extracted the GitHub Actions runner’s OIDC token from process memory. That token was used to authenticate publishes directly to the npm registry via the project’s OIDC trusted-publisher binding, bypassing the need for a static npm token entirely.

This is a significant escalation from traditional npm token theft. The attacker did not steal a stored npm API token, they stole a dynamically issued OIDC token that the CI system itself used to prove its identity to the registry.

The Malicious Payload#

The npm packages received an added router_init.js file - a ~2.3 MB heavily obfuscated file using javascript-obfuscator patterns (string-array rotation, hex-encoded identifier lookups, control-flow flattening inside while(!![]){} state machines, dead-code injection). This is distinct from normal minifier output from Terser, esbuild, or swc.

The file spawns a daemonized process that:

• Reads and exfiltrates GITHUB_* environment variables (GitHub Actions secrets, tokens, actor identity)
• Probes http://169.254.169.254/latest/meta-data/iam/security-credentials/ (AWS metadata service)
• Probes http://127.0.0.1:8200 (HashiCorp Vault)
• Downloads a platform-specific Bun runtime from hxxps://github[.]com/oven-sh/bun/releases/download/bun-v1.3.13/
• Downloads the main payload from hxxps://git-tanstack[.]com/transformers.pyz
• Communicates with hxxp://filev2[.]getsession[.]org/file/ as the command-and-control server

The package.json was also modified to include:

1
"optionalDependencies": {
2
  "@tanstack/setup": "github:tanstack/router#79ac49eedf774dd4b0cfa308722bc463cfe5885c"
3
}

That commit (79ac49eedf774dd4b0cfa308722bc463cfe5885c) is a root commit with no parent history that introduces only a package.json and bundled tanstack_runner.js payload. The prepare lifecycle hook runs bun run tanstack_runner.js && exit 1, executing arbitrary code during installation of the git-based dependency. Even before the package is fully installed in a project.

PyPI Payload Difference#

The PyPI packages use a different delivery mechanism. On import, a Python dropper downloads transformers.pyz from hxxps://git-tanstack[.]com/transformers.pyz and executes it with python3. This is the same attacker-controlled domain used in the npm campaign, confirming the same infrastructure.

1. Identify affected installations#

Check your dependency tree for router_init.js files. Socket published the following SHA-256 for detection:

1
ab4fcadaec49c03278063dd269ea5eef82d24f2124a8e15d7b90f2fa8601266c

Run:

1
find . -name "router_init.js" -exec shasum -a 256 {} \;

2. Rotate all exposed secrets#

If you installed any affected @tanstack/* version between May 11–12, 2026, rotate the following immediately in priority order:

1. GitHub PATs and OIDC federation grants - especially any trusts used for npm publishing
2. npm tokens - all active publishing tokens, even if TanStack claims none were stolen directly
3. AWS credentials - static keys and instance role tokens (the payload probes the EC2 metadata service)
4. Vault tokens - the payload probes localhost:8200
5. SSH keys - if any were present in the CI environment

3. Revoke GitHub Actions OIDC trust#

The attack extracted OIDC tokens from GitHub Actions runner memory. If your organization uses OIDC trusted publishers for npm or other registry publishing, review and rotate those federation grants.

4. Pin and audit dependencies#

• Audit package.json for unexpected optionalDependencies referencing git URLs, especially GitHub commits that aren’t part of your normal dependency graph
• Audit your lockfile for newly added transitive dependencies you didn’t expect
• Consider pinning @tanstack/* to specific versions rather than semver ranges during this period

5. Review CI logs#

Check your GitHub Actions logs for any unusual behavior between May 11–12: unexpected network calls, spawning of unfamiliar processes, or access to secrets outside normal workflow steps.

6. Enable supply chain protections#

The pnpm 11 release (May 4, 2026) introduced defaults specifically aimed at the conditions this attack exploited:

• Minimum Release Age (24h default): Newly published package versions are not resolved until they are at least one day old, reducing exposure during the highest-risk window immediately after publication
• Block Exotic Subdeps (on by default): Prevents transitive dependencies from resolving from git repositories or direct tarball URLs, narrowing one path attackers use to hide unexpected code

If you use pnpm, upgrading to v11 and keeping the defaults on significantly reduces the risk of fast-moving supply chain attacks succeeding silently.

For npm and Yarn users, similar protections exist via Socket’s AI Scanner and SafeDep’s Package Manager Guard.