--- title: "TanStack Details Sophisticated npm Supply Chain Attack That Compromised 42 Packages" url: https://daily.dev/posts/tanstack-details-sophisticated-npm-supply-chain-attack-that-compromised-42-packages-bjod4ssnq source_url: https://www.infoq.com/news/2026/05/tanstack-supply-chain-attack type: article source: "InfoQ" published: 2026-05-19T12:02:22.899Z updated: 2026-05-19T12:02:46.433Z tags: ["cyber", "cicd", "github-actions", "npm", "tanstack"] reading_time: 4 upvotes: 0 comments: 0 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # TanStack Details Sophisticated npm Supply Chain Attack That Compromised 42 Packages **[InfoQ](https://daily.dev/sources/infoq)** · 4 min read · 0 upvotes · 0 comments ## Summary TanStack published a detailed postmortem of a supply chain attack that compromised 42 npm packages and published 84 malicious versions in just six minutes on May 11. Attackers exploited GitHub Actions cache poisoning and unsafe pull_request_target workflows to mint OIDC tokens capable of publishing directly to npm — without ever stealing npm credentials. The malware harvested cloud credentials (AWS, GCP, Kubernetes, Vault), SSH keys, and GitHub tokens from developer and CI environments, then attempted to self-propagate to other packages maintained by affected developers. External researchers detected the compromise within ~20 minutes. TanStack has since hardened its pipelines by removing unsafe workflow patterns, pinning Actions to immutable SHAs, and adding stricter publishing controls. The incident underscores that modern software supply chains are increasingly attacked through CI/CD pipelines, shared caches, and trusted automation infrastructure rather than direct credential theft. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: --- Tags: [#cyber](https://daily.dev/tags/cyber), [#cicd](https://daily.dev/tags/cicd), [#github-actions](https://daily.dev/tags/github-actions), [#npm](https://daily.dev/tags/npm), [#tanstack](https://daily.dev/tags/tanstack) [View this post on daily.dev](https://daily.dev/posts/tanstack-details-sophisticated-npm-supply-chain-attack-that-compromised-42-packages-bjod4ssnq)