Mini Shai-Hulud Worms Through TanStack npm Packages

TeamPCP’s self-propagating malware compromised 84 versions across 42 TanStack npm packages by chaining a pull_request_target workflow pattern, GitHub Actions cache poisoning, and OIDC tokens extracted straight from runner memory. The worm harvests credentials from over 100 file paths and CI environments, then uses the stolen tokens to spread itself to other packages owned by compromised maintainers. It does all that while publishing with valid SLSA provenance, because attestations prove which pipeline built an artifact, not whether that pipeline was possessed. The TanStack team’s postmortem is commendably transparent: external researchers detected the attack within 20–26 minutes, all malicious versions (tracked in the original disclosure issue) were deprecated within about an hour and three quarters of publication, and workflows have since been hardened with pinned action references and purged caches. The GitHub advisory for CVE-2026-45321 rates it CVSS 9.6 and says to treat any machine that installed an affected version as compromised and rotate every credential it could reach. The HN discussion adds a delightful detail: the payload included a dead-man’s switch that destroys user data if the stolen tokens get revoked, which turns incident response into a hostage situation.