erroneo.us
Search all guides⌘K

Security Digest · May 11, 2026 · Supply-chain compromise · CI/CD

Mini Shai-Hulud: TanStack npm Worm With Valid Provenance

May 2026 worm (CVE-2026-45321) hit 42 @tanstack Router/Start packages, Mistral, UiPath, OpenSearch; 170+ packages. Check May 11-19 installs; mind the wiper.

Published By erroneo.us Security Desk · Updated 3 min read5 sources

Our verdict

Check exposure

If a lockfile picked up one of the bad TanStack Router/Start, Mistral or OpenSearch versions in mid-May 2026, treat that host as fully compromised and disable the dead-man's switch before rotating anything; everyone else can confirm and move on.

Who must act: Teams that installed @tanstack Router/Start packages on May 11, 2026, or the Mistral, Guardrails AI, UiPath, OpenSearch or other worm-propagated versions during the campaign.

Who can relax: TanStack Query, Table, Form, Virtual and Store users were not affected, and every TanStack version available on npm since May 15, 2026 is clean.

Affected
42 @tanstack/* Router/Start packages, two malicious versions each (e.g. @tanstack/react-router, router-core, solid-router, vue-router 1.169.5 and 1.169.8; @tanstack/react-start 1.167.68 and 1.167.71)
@mistralai/mistralai 2.2.2-2.2.4 (npm), mistralai 2.4.6 (PyPI)
guardrails-ai 0.10.1 (PyPI)
@opensearch-project/opensearch 3.5.3, 3.6.2, 3.7.0, 3.8.0
Other worm-propagated packages incl. @uipath, @squawk, @tallyui scopes
Fixed in
@tanstack/react-router 1.169.9, @tanstack/react-start 1.167.72, @tanstack/router-plugin 1.167.42 (see GHSA for each package)
Malicious tarballs removed from npm on May 11, 2026
CVSS
9.6 (v3.1, CNA)
EPSS
1.1% (percentile 64)
CISA KEV
Yes, listed as known exploited
Exploitation
Exploited in the wild
Severity
Critical

What to do

  1. Check lockfiles for GHSA-g7cv-rxg3-hmpx versions and for the @tanstack/setup git optionalDependency
  2. On affected hosts, disable and delete gh-token-monitor (systemd unit, LaunchAgent, script) BEFORE revoking tokens
  3. Remove .claude/ and .vscode/ hooks and injected codeql_analysis.yml workflows; revert commits by claude@users.noreply.github.com
  4. Rotate npm, GitHub, AWS, GCP, Vault, Kubernetes and SSH credentials and secrets in Claude Code session logs
  5. Block *.getsession.org, api.masscan.cloud and git-tanstack.com
  6. Scope npm trusted publishing to a workflow file and protected branch; stop running fork code in pull_request_target

How to check if you are affected or compromised

  • grep -rn '79ac49eedf774dd4b0cfa308722bc463cfe5885c' package-lock.json pnpm-lock.yaml yarn.lock node_modules/@tanstack/*/package.json
  • find . -name router_init.js -exec shasum -a 256 {} \; (malicious: ab4fcada...1266c)
  • ls ~/.config/systemd/user/gh-token-monitor.service ~/Library/LaunchAgents/com.user.gh-token-monitor.plist ~/.local/bin/gh-token-monitor.sh
  • git log --all --author=claude@users.noreply.github.com; DNS logs for filev2.getsession.org

What happened#

On May 11, 2026, attackers published 84 malicious versions of 42 @tanstack/* packages, all from the Router/Start monorepo, in two batches at 19:20 and 19:26 UTC. No npm token was stolen. According to TanStack's postmortem, the attacker chained three CI weaknesses:

  • a bundle-size.yml workflow that used pull_request_target but built code from a fork;
  • GitHub Actions cache poisoning, which planted a malicious pnpm store that the release workflow restored hours later;
  • extraction of the release job's OIDC token from runner memory, used to publish straight to npm.

Because the publishes came from TanStack's real workflow identity, they carried valid SLSA Build Level 3 provenance. Researchers describe this as a first for a documented npm worm.

The payload, an obfuscated router_init.js of about 2.3 MB, is triggered through a git-hosted optionalDependencies entry, @tanstack/setup, whose prepare script runs it with Bun. Snyk's analysis lists what it steals: GitHub Actions secrets, AWS (including IMDS and Secrets Manager), Vault, Kubernetes service-account tokens, ~/.npmrc, SSH keys and Claude Code session logs. It exfiltrates over the Session P2P network (*.getsession.org) and through GitHub dead-drop commits. It republishes the victim's own packages, forging Sigstore attestations, and plants persistence in .claude/settings.json and .vscode/tasks.json. A gh-token-monitor dead-man's switch runs rm -rf ~/ if its token is revoked. TeamPCP claimed the attack.

Who is affected#

GHSA-g7cv-rxg3-hmpx (CVE-2026-45321, CVSS 3.1 9.6) lists all 42 packages with their patched versions. Examples: @tanstack/react-router is fixed in 1.169.9, @tanstack/react-start in 1.167.72 and @tanstack/router-plugin in 1.167.42. The GHSA shows each affected span as a range, but the malicious publishes were two versions per package, such as 1.169.5 and 1.169.8. Query, Table, Form, Virtual and Store were clean. CISA added CVE-2026-45321 to the KEV catalog on May 27, 2026 and marks it as known to be used in ransomware campaigns. Per The Hacker News, the worm also reached @mistralai/mistralai, mistralai 2.4.6 on PyPI, guardrails-ai 0.10.1, @opensearch-project/opensearch 3.5.3/3.6.2/3.7.0/3.8.0, UiPath and others. OX Security counted more than 170 packages across npm and PyPI. A variant of the same malware later powered the August 2026 ChainDrop worm.

Do you really need to act?#

Only if you resolved a bad version during its window. TanStack's versions were live for roughly two to four hours before deprecation and removal. Long-lived lockfiles and Bun installs (Bun skips lifecycle scripts by default) were mostly spared. If you did install one, this is a full host compromise with a destructive trap attached. The order of operations matters more than speed. Isolate the host, kill the dead-man's switch, then rotate. The deeper lesson for maintainers: provenance proves which workflow published a package, not that the workflow was honest.

What to do now#

  1. Search lockfiles for the GHSA versions and for github:tanstack/router#79ac49ee. Run npm ls @tanstack/react-router @tanstack/router-core --all.
  2. On any affected host, stop and delete gh-token-monitor first: systemctl --user disable --now gh-token-monitor on Linux, or launchctl unload ~/Library/LaunchAgents/com.user.gh-token-monitor.plist on macOS. Then remove the script. Image the machine if you need forensics.
  3. Remove .claude/router_runtime.js, .claude/setup.mjs, .vscode/setup.mjs and the hook entries, plus any .github/workflows/codeql_analysis.yml you did not write.
  4. Rotate npm tokens and OIDC trusted-publisher grants, then GitHub PATs, cloud keys, Vault and Kubernetes tokens, SSH keys, and anything pasted into Claude Code sessions.
  5. Block *.getsession.org, api.masscan.cloud and git-tanstack.com at DNS or egress.
  6. Maintainers: pin trusted publishing to a specific workflow and refs/heads/main, grant id-token: write only to the publish job, never build fork code under pull_request_target, and purge Actions caches.

How to tell if you were hit#

Look for router_init.js (SHA-256 ab4fcada…1266c) or tanstack_runner.js in node_modules/@tanstack. Other signs: commits authored by claude@users.noreply.github.com, branches matching dependabout/…/setup-formatter, npm tokens described "IfYouRevokeThisTokenItWillWipeTheComputerOfTheOwner", DNS lookups of filev2.getsession.org, and public repos described "Shai-Hulud: Here We Go Again". For the PyPI variants, look for /tmp/transformers.pyz.

Timeline#

  • — Attacker forks TanStack/router and stages a malicious commit.
  • — Cache poisoned at 11:29 UTC; 84 malicious versions published at 19:20-19:26; StepSecurity reports at 19:46; GHSA published and tarballs removed by 23:55.
  • — Spread to Mistral, Guardrails AI, OpenSearch, UiPath and others is reported.
  • — TanStack issues an all-clear for all currently published versions.
  • — CISA adds CVE-2026-45321 to KEV (due date June 10).

Vulnerability records

  • CVE-2026-45321 · KEV 2026-05-27 · On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry.

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

  1. TanStack — npm supply chain compromise postmortem tanstack.com
  2. GitHub Advisory — GHSA-g7cv-rxg3-hmpx github.com
  3. Snyk — TanStack npm packages hit by Mini Shai-Hulud snyk.io
  4. CISA — Known Exploited Vulnerabilities Catalog (CVE-2026-45321) cisa.gov

Coverage and analysis

  1. The Hacker News — Mini Shai-Hulud worm compromises TanStack, Mistral AI, Guardrails AI and more thehackernews.com