Snyk: TanStack Supply Chain Attack: OIDC Token Theft Explained

Name: Snyk: TanStack Supply Chain Attack: OIDC Token Theft Explained
Uploaded: 2026-06-18T17:42:21-04:00
Duration: 1 min 45 s
Description: TL;DR On May 11, 2026, attackers compromised 84 malicious npm package versions across 42 TanStack packages by hijacking the legitimate release pipeline rather than stealing credentials. The attack exploited three chained vulnerabilities: GitHub Actions...

Snyk

06/18/2026

0 (0%)

Report Like Favorite

TL;DR

On May 11, 2026, attackers compromised 84 malicious npm package versions across 42 TanStack packages by hijacking the legitimate release pipeline rather than stealing credentials.
The attack exploited three chained vulnerabilities: GitHub Actions workflow misconfiguration, cache poisoning, and OIDC token extraction from runner memory to publish with TanStack's trusted identity.
Malicious packages shipped with valid SLSA build level 3 provenance attestations, demonstrating that cryptographic certificates alone cannot prevent sophisticated supply chain attacks when the pipeline itself is compromised.

Summary

This briefing examines a sophisticated supply chain attack that compromised 84 malicious npm package versions across 42 TanStack packages on May 11, 2026. Unlike traditional credential theft attacks, this incident exploited GitHub Actions workflows to hijack TanStack's legitimate release pipeline mid-execution. The attacker published malicious packages using TanStack's own trusted identity, complete with valid SLSA build level 3 provenance attestations—cryptographic certificates designed to verify package integrity. The attack chained three distinct vulnerabilities: a Pwn request exploiting GitHub Actions workflow misconfiguration, GitHub Actions cache poisoning executed eight hours before the release workflow, and OIDC token extraction from runner process memory. Within hours, the attack self-propagated to Mistral AI, UiPath, and dozens of other npm namespaces, ultimately affecting over 170 packages. This incident represents wave four of the ShyHalut campaign attributed to TeamPCP, the same threat group linked to the Bitwarden CLI compromise in April 2026 and the Aqua Security TriviScanner attack in March 2026.

Chapters

0:00 - Attack Overview
0:17 - Pipeline Hijacking Method
0:46 - Three-Vulnerability Chain
1:17 - Propagation and Attribution

Key Quotes

0:17 "Here's what makes this attack different from every supply chain attack before it."
0:21 "The attacker did not steal tanstack's credentials. They hijacked the tanstack's legitimate release pipeline mid-workflow and published using tanstack's own trusted identity."
0:37 "That's a mouthful, but it's the cryptographic certificates that are supposed to help ensure a package is safe. In this case, those certificates were legitimate. The pipeline was not."

FAQ

How did this attack differ from typical supply chain compromises?

Instead of stealing credentials, the attacker hijacked TanStack's legitimate release pipeline mid-workflow and published malicious packages using the project's own trusted identity, complete with valid cryptographic certificates that are supposed to verify package safety.

What are the three vulnerabilities that were chained together in this attack?

The attack exploited a Pwn request targeting GitHub Actions workflow misconfiguration, GitHub Actions cache poisoning executed eight hours before the release workflow ran, and OIDC token extraction from runner process memory to steal authentication tokens before the legitimate publish step.

Categories:

» Cybersecurity » Application Security
» Data Protection

Tags:

Show more Show less

TL;DR

Summary

Chapters

Key Quotes

FAQ

Discover DLP Memories: The ever-evolving triage agent enhancing efficiency each shift.

Safeguarding Sensitive Data in the Age of AI Platforms

AI Agents Revolutionizing Identity Attacks: Same Tactics, Enhanced Speed