← Back to feed
2026-05-24 Supply ChainMalware TLP:CLEAR

TanStack & Mistral GitHub Actions Pwn Request Supply Chain Attack: 170+ Packages Compromised via Cache Poisoning & OIDC Token Extraction

Date: 2026-05-24
Tags: supply-chain, malware

Executive Summary

On 2026-05-11 between 19:20 and 19:26 UTC, an attacker published 84 malicious versions across 42 @tanstack/* npm packages by combining: the pull_request_target "Pwn Request" pattern, GitHub Actions cache poisoning across the fork↔base trust boundary, and runtime memory extraction of an OIDC token from the GitHub Actions runner process. A coordinated supply chain attack on May 11, 2026 compromised over 170 npm packages and 2 PyPI packages, totaling 404 malicious versions. The attacker hit the entire TanStack router ecosystem (42 packages), Mistral AI's SDK suite (on both npm and PyPI), UiPath's automation tooling (65 packages), OpenSearch (1.3M weekly npm downloads), and Guardrails AI (PyPI). The packages passed SLSA provenance checks, carried valid signed certificates, and looked 100% legitimate to every security tool checking cryptographic proof of origin.

Campaign Summary

FieldDetail
Campaign / MalwareMini Shai-Hulud Wave 2 / TanStack Attack
AttributionTeamPCP (confidence: high)
TargetOpen-source npm and PyPI ecosystems; downstream consumers including Mistral AI, UiPath, OpenSearch, Guardrails AI
VectorGitHub Actions Pwn Request pattern + Actions cache poisoning + OIDC token extraction from runner memory
Statusactive
First Observed2026-05-11

Detailed Findings

The TanStack compromise exploited a chain of three vulnerabilities in GitHub Actions. The attacker created a fork of the TanStack/router repository (renamed to zblgg/configuration to evade fork-list searches), then opened a pull request that triggered a pull_request_target workflow. This workflow checked out and executed the attacker's fork code, which poisoned the GitHub Actions cache with a malicious pnpm store. When legitimate maintainer PRs were later merged to main, the release workflow restored the poisoned cache. Attacker-controlled binaries then extracted OIDC tokens directly from the GitHub Actions runner's process memory (/proc/<pid>/mem). The attacker was able to use these tokens to publish the malicious package versions without ever stealing npm credentials. If one of these packages was installed on your machine, there is a script running right now that polls your GitHub token every 60 seconds. The moment you revoke that token, the way every security playbook says to it runs rm -rf ~/. Your entire home directory is gone. The incident is attributed by StepSecurity to the threat group known as TeamPCP, and it is also the first documented case of a malicious npm package carrying valid SLSA provenance.

MITRE ATT&CK Mapping

TechniqueIDContext
Supply Chain CompromiseT1195Malicious code injected into widely-used open-source packages via GitHub Actions workflow hijacking
Obtain Capabilities - MalwareT1588.001Credential harvesting worm with self-propagation and persistence mechanisms
Lateral Tool TransferT1570Malicious payloads self-propagate through npm registry to secondary targets via stolen credentials

IOCs

Domains

git-tanstack.com
getsession.org

Full URL Paths

filev2.getsession.org
seed1.getsession.org
seed2.getsession.org
seed3.getsession.org

Splunk Format

"git-tanstack.com" OR "getsession.org" OR "filev2.getsession.org" OR "seed1.getsession.org" OR "seed2.getsession.org" OR "seed3.getsession.org"

Package Indicators

@tanstack/[email protected],1.169.8
@tanstack/[email protected],1.169.8
@tanstack/[email protected],1.169.8
@tanstack/[email protected],1.169.8
@mistralai/*@2.4.6
@uipath/*
@squawk/*
[email protected]
[email protected]
opensearch-project/opensearch

Detection Recommendations

Monitor GitHub Actions runners for memory access patterns suspicious to /proc//mem. Audit all PR-triggered workflows for pull_request_target + untrusted checkout combinations using static analyzers like zizmor. Block git-tanstack.com at DNS/proxy level. Search lockfiles and CI logs for affected @tanstack/, @mistralai/, @uipath/, @squawk/*, guardrails-ai, and opensearch-project versions published on May 11, 2026. Check for gh-token-monitor daemon persistence (~/.config/systemd/user/gh-token-monitor.service on Linux; ~/Library/LaunchAgents/com.user.gh-token-monitor.plist on macOS). If exposed, treat host as fully compromised and rotate all credentials before token revocation to prevent wiper trigger (rm -rf ~/).

References