Snyk: TanStack NPM Attack: Critical Remediation Steps

Name: Snyk: TanStack NPM Attack: Critical Remediation Steps
Uploaded: 2026-06-24T07:44:55-04:00
Duration: 40 s
Description: TL;DR The TanStack npm attack installed malware that monitors GitHub API responses every 60 seconds using stolen tokens Revoking your GitHub token before removing the malware triggers a destructive wipe of your entire home directory This represents one...

Snyk

06/24/2026

0 (0%)

Report Like Favorite

TL;DR

The TanStack npm attack installed malware that monitors GitHub API responses every 60 seconds using stolen tokens
Revoking your GitHub token before removing the malware triggers a destructive wipe of your entire home directory
This represents one of the most technically sophisticated npm supply chain attacks with remediation order being critical

Summary

This security alert details a sophisticated supply chain attack targeting the TanStack npm package on May 11th. The malware installs a persistent background service that monitors GitHub API responses using stolen tokens. If a compromised token is revoked—triggering a 400 error—the malware immediately executes a destructive command that wipes the entire home directory, including source code, SSH keys, and project history. The attack represents an advanced threat that requires careful, sequenced remediation rather than immediate token revocation. Security teams must understand the malware's behavior patterns and follow specific removal procedures before taking standard incident response actions like credential rotation.

Chapters

0:00 - Attack Discovery Warning
0:11 - Malware Behavior Explained
0:26 - Attack Sophistication Assessment

Key Quotes

0:07 "... that will wipe your entire home directory. Not kidding, it's not hypothetical."
0:16 "... the moment it gets a 400 error back, it returns rmrf on your root directory."
0:26 "This attack is not just a bad package got published story, it is one of the most technically sophisticated npm supply chain attacks documented."

FAQ

What should I do first if I was affected by the TanStack npm attack?

Do not immediately revoke your GitHub token. First, identify and remove the background service installed by the malware. Only after confirming the malware is completely removed should you proceed with token revocation and other standard incident response procedures.

Categories:

» Cybersecurity » Application Security
» Data Protection

Tags:

Show more Show less

TL;DR

Summary

Chapters

Key Quotes

FAQ

Becoming Agent Ready with Cyera: Essential Strategies and Insights

Harnessing AI for Secure Innovation in the Enterprise with Netskope & Omada