📊 Full opportunity report: Three Public Vulnerabilities. Chained. on ThorstenMeyerAI.com — validation score, market gap, and execution plan.
TL;DR
In May 2026, attackers exploited three publicly documented vulnerabilities in sequence to compromise TanStack’s npm packages within six minutes. This incident underscores how attacker tradecraft now rapidly combines known flaws, outpacing defenses.
On May 11, 2026, attackers successfully compromised multiple TanStack npm packages by chaining together three previously documented vulnerabilities, all of which were publicly known for over a year. This attack was executed within six minutes and highlights how publicly available research can be weaponized rapidly, outpacing current defense measures.
The attack involved publishing 84 malicious package versions across 42 TanStack npm modules, using a combination of publicly documented vulnerabilities in the GitHub Actions ecosystem. The attacker created a fork of the TanStack/router repository, injected malicious code via a crafted commit, and exploited the pull_request_target pattern, which had been identified as dangerous by GitHub Security Lab years prior. They then used a GitHub Actions workflow configured with OIDC trusted-publisher binding to generate an in-memory OIDC token, which was exfiltrated through the Session Protocol—a secure messaging network—without stealing npm tokens or compromising the publish workflow itself.
Three known vulnerabilities formed the chain: (1) the pull_request_target ‘pwn request’ pattern, (2) cache poisoning across fork and base trust boundaries, and (3) extraction of OIDC tokens from the GitHub Actions runner memory. Each vulnerability was documented in public security research before the attack, with the latest being March 2025, yet the attacker combined them effectively within minutes of the initial breach.
Three public vulnerabilities.
Chained.
The TanStack npm compromise of May 11, 2026 — published research recombined into working tradecraft, weaponized faster than defenders deploy mitigations.
84 malicious versions across 42 packages. Six-minute publish window. No npm tokens stolen. OIDC minted in memory and exfiltrated via Session Protocol. Three vulnerabilities chained — each documented in public research 12-24 months before the attack. Same date as the GTIG zero-day disclosure. The composition is the attack surface.
Each bridges the trust boundary the others assumed.
PR fork code crossing into base-repo cache. Base-repo cache crossing into release-workflow runtime. Release-workflow runtime crossing into npm registry write access. The composition only works because each vulnerability bridges the trust boundary the others assumed.
pull_request_target for fork PRs and checked out the fork’s PR-merge ref to run a build. Bypasses first-time-contributor approval gate. Author attempted trust split but missed that actions/cache@v5‘s post-job save is not gated by permissions:. Cache scope is per-repo, shared across triggers.Linux-pnpm-store-${hashFiles('**/pnpm-lock.yaml')} — exact match. actions/cache@v5 post-step saves poisoned store to that key. Restored entirely as designed when release.yml next runs on push to main.id-token: write for legitimate npm OIDC trusted publishing. Poisoned cache invokes attacker binaries: locate Runner.Worker via /proc/*/cmdline, dump memory via /proc//maps + /proc//mem , extract OIDC token, POST to registry.npmjs.org. Bypasses workflow’s Publish Packages step entirely.The attacker did not invent novel tradecraft. They recombined published research. Verbatim Python script — attribution comment preserved — from the March 2025 tj-actions disclosure. Every defensive research publication becomes attacker reference material within 12-24 months.
Network Vulnerability Assessment: Identify security loopholes in your network's infrastructure
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
May 10 17:16 fork. May 11 19:50 detection.
From the attacker creating a renamed fork (deliberately evading fork-list searches) through the cache poisoning phase, the detonation phase, and the rapid external detection by Ashish Kurmi at StepSecurity. The TanStack postmortem published the complete root cause analysis publicly within hours.
PHASE
65bf499d authored by fabricated identity claude (NOT real Anthropic Claude). [skip ci] prefix suppresses CI on push. Adds packages/history/vite_setup.mjs — ~30,000-line bundled JS payload.PREP
pull_request_target. No first-time-contributor approval — pull_request_target bypasses that gate. pr.yml blocked.TRIGGER
65bf499d on PR head. bundle-size.yml’s benchmark-pr job checks out refs/pull/7378/merge, runs pnpm install + pnpm nx run @benchmarks/bundle-size:build. Executes fork-controlled vite_setup.mjs.EXEC
Linux-pnpm-store-6f9233a50def742c09fde54f56553d6b449a535adf87d4083690539f49ae4da11 (1.1 GB) saved for TanStack/router, scoped to refs/heads/main. Keyed to match what release.yml will compute on next push.ACTIVE
b1c061af). Visible PR diff is 0-file no-op. PR closed and branch deleted in same minute. Cache poison persists. PR appears benign in retrospective review./proc/*/cmdline, dumps memory, extracts OIDC token, POSTs to registry.npmjs.org. Bypasses defined Publish Packages step entirely.EXEC
@tanstack/history@1.161.12 etc. Six minutes between the two publish waves. Workflow status: failure (tests broke; publish still happened).BLAST
DETECTION
COMPLETE
GitHub security audit tools
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
160+ packages. One worm. Same threat actor.
The TanStack compromise is one node in the broader Mini Shai-Hulud campaign by threat group TeamPCP — the same actor behind LiteLLM PyPI (March 2026), Bitwarden CLI npm, SAP CAP npm, and Lightning PyPI (April 30, 2026). Self-propagating worm pattern. First documented npm worm with valid SLSA Build Level 3 attestations.
May 2026 wave
weekly downloads
compromised May 12
fork → detection
registry.npmjs.org/-/v1/search?text=maintainer: → republish with same injection. Active operational campaign as of May 12, 2026.
Never Miss a Thing with 2K Clarity! Plug-in Indoor Security Camera with Motion Detection for Continuous Monitoring. Easy Tabletop Setup, Secure via Cloud or SD Card.
[2K Day & Night Clarity] Plug in for continuous 2K HD recording. See clear details day or night.
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
IOCs · copy-pasteable for hunting queries.
The TanStack postmortem published comprehensive IOCs. Defenders should hunt for these across their environments. The attacker forged a “claude” identity using claude@users.noreply.github.com — not the real Anthropic Claude Code GitHub App. This identity-confusion tactic deserves specific attention in git-log audits.
bun run tanstack_runner.js && exit 1 on install — payload runs, then optional dep “fails” gracefully.router_init.js (~2.3 MB, package root, not in files array). Also: tanstack_runner.js per Socket analysis.https://litter.catbox.moe/h8nc9u.js, https://litter.catbox.moe/7rrc6l.mjs. Secondary exfil via legitimate-looking GitHub GraphQL API traffic.git log --all --author=claude@users.noreply.github.com across all repos. Force-push revert if found.zblgg (id 127806521) · voicproducoes (id 269549300 · account created 2026-03-19 — fresh account, public repos named “A Mini Shai-Hulud has Appeared”). Attacker fork: github.com/zblgg/configuration (renamed). Workflow runs: 25613093674 · 25691781302.OIDC token security tools
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Installed it? Rotate. Maintain packages? Audit.
Three response tracks. If you installed an affected version on May 11: treat your host as compromised. If you maintain OSS with similar workflow patterns: audit pull_request_target immediately. If you consume the npm ecosystem at enterprise scale: deploy install-time monitoring and lockfile pinning.
- Rotate AWS, GCP, Azure, Kubernetes service-account tokens, Vault tokens, npm
~/.npmrc, GitHub tokens, SSH private keys - Review GitHub Actions runs after 2026-05-11T19:20Z for unexpected npm publish events
- Check outbound connections to
filev2.getsession.org·seed*.getsession.org - Check downstream propagation — if your packages were published during a CI run that installed compromised version, those may also be compromised
- Audit
~/.claude/+.vscode/tasks.json· removerouter_runtime.js,setup.mjs git log --all --author=claude@users.noreply.github.com· revert if found- Run
npm token list· revoke unrecognized tokens
- Audit pull_request_target workflows immediately · never check out fork-submitted code without explicit approval gates
- Pin third-party action refs to commit SHAs ·
actions/checkout@8e5e7e5ab8...not@v6 - Separate cache scopes for trusted vs untrusted contexts · explicit
restore-keysandkeypatterns - Consider moving from OIDC trusted publisher to short-lived classic tokens with manual review
- Add internal alerting on npm publishes · fire on any publish that doesn’t originate from expected workflow step
- Audit other repos for the same bundle-size.yml-style pattern
- Restrict
id-token: writeto only the publish step that needs it
- Deploy npm package monitoring at install time · Socket / StepSecurity / Snyk · Socket flagged TanStack in 6 minutes
- Lockfile-pinned dependencies don’t auto-pull new versions · only consumers installing during the publish window were affected
- Audit lockfiles for
github:URLoptionalDependencies· unusual for production deps, exact pattern used here - CI/CD secret rotation automation · 30-90 day schedule regardless of incident status
- Treat provenance attestations as one layer, not sole verification · Mini Shai-Hulud produces valid Build L3 attestations on malicious packages
- Establish IR playbooks for OSS supply-chain compromise scenarios
Three pieces of public security research. Twelve months between the latest and the attack. Zero novel attacker tradecraft. A competent maintainer team with 2FA and OIDC trusted publishing — compromised through a chain that no individual vulnerability in their stack would have enabled. The composition is the attack surface.
Implications of Chained Public Vulnerabilities
This incident demonstrates how publicly available security research can be rapidly weaponized by attackers to execute sophisticated supply-chain compromises. The attack’s speed—six minutes from fork to malicious package publication—exposes the challenge for defenders to deploy mitigations faster than attackers can assemble known exploits. It underscores the importance of holistic security practices, including code review, trust boundary analysis, and proactive mitigation of known vulnerabilities, especially in open-source ecosystems where attack surfaces are large and trust relationships complex.
Broader 2026 Supply-Chain Attack Wave and Research-Tradecraft Linkages
The TanStack compromise is part of a broader wave of supply-chain attacks in 2026, involving over 160 packages in the Mini Shai-Hulud campaign, including high-profile entities like Mistral AI and UiPath. This attack exemplifies a trend where attacker tradecraft is compressed by the availability of detailed security research, enabling rapid, multi-stage exploits. The specific vulnerabilities exploited had been publicly documented for over a year, yet their combination in this attack illustrates a new paradigm: the acceleration of known vulnerabilities into weaponized chains via AI-augmented attack planning.
Research from GitHub Security Lab, Adnan Khan, and StepSecurity had identified each vulnerability independently, but their combined use in the attack was unprecedented. The incident also coincides with the disclosure of the first AI-built zero-day by Google Threat Intelligence Group, marking a convergence of advanced offensive capabilities with publicly available exploit knowledge.
“The TanStack incident exemplifies how attacker tradecraft now rapidly combines publicly documented vulnerabilities, outpacing defenders’ ability to deploy mitigations.”
— Thorsten Meyer
Remaining Questions About the Attack Chain and Defense Gaps
Details about the specific detection mechanisms that could have prevented this chain remain unclear. It is also not yet confirmed whether other packages or ecosystems have experienced similar rapid chaining of public vulnerabilities. The full extent of the attack’s impact on other projects is still being assessed, and the effectiveness of current mitigations against such chained exploits is under review.
Next Steps for Defense and Mitigation Strategies
Security researchers and organizations are expected to analyze the attack chain further to develop targeted detection and prevention measures. Open-source maintainers are urged to review their trust boundaries, especially around PR workflows and cache handling. Broader industry efforts may focus on automating the detection of chained vulnerabilities and implementing proactive safeguards against known public research being weaponized in real-time. Additionally, organizations will likely reassess their supply-chain security postures to address the rapid pace of AI-augmented attacks.
Key Questions
How did the attacker execute the chain of vulnerabilities so quickly?
The attacker combined publicly documented vulnerabilities in GitHub Actions and npm workflows, leveraging automation and AI-augmented tradecraft to execute the chain within six minutes of initial fork creation.
Are these vulnerabilities still exploitable today?
Since the vulnerabilities are publicly known and documented, they remain exploitable unless actively mitigated. Organizations should review their trust boundaries and apply recommended mitigations to reduce risk.
What can open-source projects do to defend against such attacks?
Projects should implement stricter review processes for pull requests, monitor trust boundary crossings, and deploy automated detection for chaining known vulnerabilities. Maintaining awareness of public research and applying timely mitigations is critical.
Does this incident suggest a new era of AI-driven supply-chain attacks?
Yes, the incident underscores how AI and public research enable faster, more sophisticated exploitation of known vulnerabilities, challenging traditional defensive timelines.
Source: ThorstenMeyerAI.com
