{"id":170684,"date":"2026-05-15T00:24:32","date_gmt":"2026-05-14T22:24:32","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/v-42-npm-paketa-tanstack-integrirovan-samorasprostranyayushhijsya-cherv"},"modified":"2026-05-15T00:24:32","modified_gmt":"2026-05-14T22:24:32","slug":"v-42-npm-paketa-tanstack-integrirovan-samorasprostranyayushhijsya-cherv","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/v-42-npm-paketa-tanstack-integrirovan-samorasprostranyayushhijsya-cherv","title":{"rendered":"A self-replicating worm has been integrated into 42 TanStack NPM packages","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
As a result of the compromise of the release process based on GitHub Actions in the TanStack project, the attacker managed to publish 84 malicious versions in the NPM repository, affecting 42 NPM packages from the TanStack stack. Some of the compromised packages had over 10 million downloads per week. <\/p>\n
Access to the release publication was obtained due to an incorrect configuration of the pull_request_target \u2018Pwn Request\u2019 in GitHub Actions (the mask setting led to the activation of pull_request_target for pull requests from third-party forks), caching poisoning of GitHub Actions through forks, and the ability to extract the OIDC token from the memory of the running runner process (Runner.Worker) by reading the contents of \/proc\/\/mem. <\/p>\n
The NPM packages with malicious changes were published on May 11 from 22:20 to 22:26 (MSK), noticed after 20 minutes and blocked in an hour and a half. For each affected NPM package, two malicious versions were released, which integrated code to activate the mini-shai-hulud worm, searching for tokens and credentials in the current environment. If a token connecting to the NPM registry was found, the worm would automatically publish new malicious releases for packages under development in the current environment, contaminating the dependency tree. In this way, over 400 NPM packages that used TanStack packages as dependencies were compromised. <\/p>\n
The worm was embedded in the file router_init.js and was activated when the affected package was manually installed by the developer or automatically in a continuous integration environment using the commands \u2018npm install\u2019, \u2018pnpm install\u2019, or \u2018yarn install\u2019. Upon activation, the worm searched the system for NPM tokens (~\/.npmrc), AWS, GCP, Azure, HashiCorp, and Kubernetes K8s, as well as SSH private keys. The discovered data was sent to the attackers via the decentralized P2P messenger getsession.org. <\/p>\n
The worm was designed to perform destructive actions in case of revocation of the intercepted NPM token \u2014 the system was set up to periodically run the script ~\/.local\/bin\/gh-token-monitor.sh, which checked the token's activity every 60 seconds by querying api.github.com\/user and if the token was revoked, it would execute the command \u2018rm -rf ~\/\u2019. \n Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"