TanStack Vulnerability Exploits GitHub Actions for Credential Theft

What changed

On May 11, 2026, a series of malicious packages were published to the npm registry, affecting TanStack's ecosystem. The attack utilized a combination of known vulnerabilities to execute a sophisticated supply chain attack.

The exploitation involved leveraging a misconfiguration in the pull_request_target, cache poisoning in GitHub Actions, and extracting OIDC tokens from the runner process, allowing attackers to masquerade as trusted publishers.

Who is affected

The vulnerability primarily impacts users and developers utilizing TanStack packages, particularly those relying on the npm registry for package management.

Organizations employing GitHub Actions for CI/CD workflows may also be at risk, especially if they have not implemented adequate security measures.

• Developers using @tanstack/* packages
• Organizations employing GitHub Actions for their workflows
• Users of npm registry who integrate TanStack packages into their projects
• Companies relying on third-party libraries that include TanStack components

What to do

It is crucial for developers and organizations to review their dependency management practices and ensure that they are using trusted sources for package installations.

Implementing security measures such as dependency scanning and monitoring for unusual activity in CI/CD pipelines can help mitigate risks associated with such vulnerabilities.

• Audit and update TanStack packages to the latest versions
• Review GitHub Actions workflows for potential misconfigurations
• Enable dependency scanning tools to detect malicious packages
• Educate teams on secure coding practices and the importance of package integrity