TanStack npm supply chain was attacked: 42 packages, 84 malicious versions, HN 710 points hot discussion

Core conclusion

On May 11, 2026 19:20-19:26 UTC, TanStack (the maintainer of well-known libraries such as React Query, React Table, React Router, etc.) suffered a well-orchestrated npm supply chain attack. The attackers exploited three chains of design flaws in GitHub Actions and successfully released 84 malicious versions on 42 @tanstack/* packages.

The sophistication and scope of the attack are extremely rare in the history of open source npm package management, directly threatening all developers using the TanStack ecosystem. It was discovered by external researchers in just 20 minutes, but the attacker's malicious code has the ability to spread itself, even affecting non-TanStack projects such as MistralAI.

Key Points

• Event occurrence time: 2026-05-11 19:20-19:26 UTC (early morning of the next day, Beijing time) -Affected objects: All npm/Node.js developers, especially projects using the TanStack ecosystem
• Core Change: Systemic vulnerability in npm Supply Chain Security's GitHub Actions trust model
• Popularity score: 92/100 (HN 710 points + extensive community discussion)

Attack method: three vulnerability chains

The biggest feature of this attack is that the attacker exploited a chain combination of three GitHub Actions design flaws, one of which is indispensable:

Every step of the attack chain is very clever: the attacker first creates a harmless-looking fork repository (renamed to something less noticeable), submits an "orphan commit" containing ~30,000 lines of obfuscated JS code to the fork, and then launches a PR to the main repository. Due to a design flaw in the pull_request_target trigger, this PR is automatically run in the context of the native repository, thus bypassing the limitations of the fork repository.

Key Timeline (UTC)

1. 19:20 — The attacker creates a fork to TanStack/router, submits a malicious payload (~2.3 MB obfuscated JS), and sends a PR from the fork
2. 19:21 — Malicious lifecycle script execution: stealing credentials (AWS/GCP/K8s/Vault), network outbound via Session/Oxen end-to-end encrypted messaging, self-propagating to other packages within the victim’s organization
3. 19:22 — GitHub Actions test phase trigger: malicious code publishes a malicious version to the npm registry using workflow's OIDC identity
4. 19:26 — Completed the release of all 42 packages × 2 versions
5. 19:46 — External researchers discovered and submitted Issue #7383, fully publishing the malicious fingerprint and package list

Self-propagation mechanism: not just TanStack

The most alarming thing is that this malicious payload has the ability to propagate itself. When run on the victim's machine, it:

• Enumerate all npm packages maintained by the victim via registry.npmjs.org/-/v1/search?text=maintainer:<user>
• Create a "dead-man's switch" daemon (Linux systemd / macOS LaunchAgent) that polls the GitHub API every minute to check if the token has been revoked
• If the token is revoked, perform a wipe operation of rm -rf ~/. - this means that even if the victim discovers the problem in time, the recovery process may face data loss

The malicious payload was ultimately confirmed to also affect the @mistralai/mistralai npm package, indicating that the attackers were building a cross-project supply chain worm rather than targeting a specific target.

Impact on developers

If you are a developer in the npm/Node.js ecosystem, this attack exposed several security risks that you must face up to:

1. Trusted Publishing ≠ Security Barrier

GitHub's Trusted Publishing (OIDC Trusted Publishing) is widely promoted as a best practice for npm security, but this attack proves that once attackers enter your CI pipeline, OIDC tokens become a convenient conduit for them to publish malicious packages. In contrast, local publishing + 2FA is more secure.

2. The postinstall script is a double-edged sword

The malicious payload of this attack was executed through the postinstall lifecycle script of npm install. Developers in the comment area have called for everyone to switch to pnpm, because only pnpm prohibits self-execution of postinstall scripts by default.

3. The GitHub Actions trust model needs to be revisited

The design of the pull_request_target trigger allows fork PRs to be executed in the context of the native repository - a design that inherently presents security risks. Attackers used this to bypass the first-time contributor approval mechanism. Chris Weekly's comment on HN hit the nail on the head: "It's crazy that a commit from a malicious fork can be retrieved in a URI via GitHub Shared Object Storage and indistinguishable from a legitimate repository."

Fixes and suggestions

The TanStack team responded quickly when the issue was discovered:

• 19:46 — Emergency response initiated immediately following external report
• Immediately remove GitHub push permissions from other team members (to prevent the user's machine from being compromised)
• Start npm deprecation process (all 84 malicious versions)
• Publish official GitHub Security Advisory (CVE filed)

Specific advice for developers:

• If you are a TanStack user and have pulled dependencies after 2026-05-11, check the dependency version immediately
• Lock third-party action references in CI pipelines to SHA (not tag/branch)
• Consider using separate CI VM isolation for each project (Docker may not be enough)
• Use pnpm instead of npm - stricter life cycle script control
• Review your GitHub Actions workflow for use of pull_request_target

Tool entry (trigger tool floating card)

The tools and technology stack involved in this attack have application scenarios in security analysis tools such as n8n (automated monitoring), GitHub Actions (CI/CD security), OpenAI/Claude (possible code audit assistance) and other fields. Developers can use automated tools to enhance supply chain security monitoring.

Internal link guidance

• Want to learn how to build a secure CI/CD pipeline with AI automation tools? Watch: n8n + OpenAI
• npm Supply chain security is not just for large projects: Risk scenarios every developer using AI automation tools should know, Reference: Zero-code AI mini program: Wegic helps you launch a mini program with a monthly income of 5,000 yuan in one week
• Protect your project with automated monitoring: master the same automated thinking as How to build an AI content automated distribution system with n8n + ChatGPT: a complete 30-minute tutorial to build a security alarm pipeline

Reference sources

• TanStack Postmortem Original text: Postmortem: TanStack npm supply-chain compromise
• HN thread: 710
• MistralAI related Issue: @mistralai/mistralai