---
title: "Mini Shai-Hulud: TanStack npm Worm With Valid Provenance"
url: https://erroneo.us/security/briefs/mini-shai-hulud-tanstack-npm-worm/
description: "May 2026 worm (CVE-2026-45321) hit 42 @tanstack Router/Start packages, Mistral, UiPath, OpenSearch; 170+ packages. Check May 11-19 installs; mind the wiper."
type: security-brief
section: "Security Digest"
date_published: 2026-05-11
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2026-45321"]
severity: "critical"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# Mini Shai-Hulud: TanStack npm Worm With Valid Provenance

**Verdict: Check exposure.** If a lockfile picked up one of the bad TanStack Router/Start, Mistral or OpenSearch versions in mid-May 2026, treat that host as fully compromised and disable the dead-man's switch before rotating anything; everyone else can confirm and move on.

- **Who must act:** Teams that installed @tanstack Router/Start packages on May 11, 2026, or the Mistral, Guardrails AI, UiPath, OpenSearch or other worm-propagated versions during the campaign.
- **Who can relax:** TanStack Query, Table, Form, Virtual and Store users were not affected, and every TanStack version available on npm since May 15, 2026 is clean.
- **Affected:** 42 @tanstack/* Router/Start packages, two malicious versions each (e.g. @tanstack/react-router, router-core, solid-router, vue-router 1.169.5 and 1.169.8; @tanstack/react-start 1.167.68 and 1.167.71); @mistralai/mistralai 2.2.2-2.2.4 (npm), mistralai 2.4.6 (PyPI); guardrails-ai 0.10.1 (PyPI); @opensearch-project/opensearch 3.5.3, 3.6.2, 3.7.0, 3.8.0; Other worm-propagated packages incl. @uipath, @squawk, @tallyui scopes
- **Fixed:** @tanstack/react-router 1.169.9, @tanstack/react-start 1.167.72, @tanstack/router-plugin 1.167.42 (see GHSA for each package); Malicious tarballs removed from npm on May 11, 2026
- **CVEs:** CVE-2026-45321
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Check lockfiles for GHSA-g7cv-rxg3-hmpx versions and for the @tanstack/setup git optionalDependency
2. On affected hosts, disable and delete gh-token-monitor (systemd unit, LaunchAgent, script) BEFORE revoking tokens
3. Remove .claude/ and .vscode/ hooks and injected codeql_analysis.yml workflows; revert commits by claude@users.noreply.github.com
4. Rotate npm, GitHub, AWS, GCP, Vault, Kubernetes and SSH credentials and secrets in Claude Code session logs
5. Block *.getsession.org, api.masscan.cloud and git-tanstack.com
6. Scope npm trusted publishing to a workflow file and protected branch; stop running fork code in pull_request_target

### How to check if you are affected

- grep -rn '79ac49eedf774dd4b0cfa308722bc463cfe5885c' package-lock.json pnpm-lock.yaml yarn.lock node_modules/@tanstack/*/package.json
- find . -name router_init.js -exec shasum -a 256 {} \; (malicious: ab4fcada...1266c)
- ls ~/.config/systemd/user/gh-token-monitor.service ~/Library/LaunchAgents/com.user.gh-token-monitor.plist ~/.local/bin/gh-token-monitor.sh
- git log --all --author=claude@users.noreply.github.com; DNS logs for filev2.getsession.org

## What happened

On May 11, 2026, attackers published 84 malicious versions of 42 `@tanstack/*` packages, all from the Router/Start monorepo, in two batches at 19:20 and 19:26 UTC. No npm token was stolen. According to [TanStack's postmortem](https://tanstack.com/blog/npm-supply-chain-compromise-postmortem), the attacker chained three CI weaknesses:

- a `bundle-size.yml` workflow that used `pull_request_target` but built code from a fork;
- GitHub Actions cache poisoning, which planted a malicious pnpm store that the release workflow restored hours later;
- extraction of the release job's OIDC token from runner memory, used to publish straight to npm.

Because the publishes came from TanStack's real workflow identity, they carried valid SLSA Build Level 3 provenance. Researchers describe this as a first for a documented npm worm.

The payload, an obfuscated `router_init.js` of about 2.3 MB, is triggered through a git-hosted `optionalDependencies` entry, `@tanstack/setup`, whose `prepare` script runs it with Bun. [Snyk's analysis](https://snyk.io/blog/tanstack-npm-packages-compromised/) lists what it steals: GitHub Actions secrets, AWS (including IMDS and Secrets Manager), Vault, Kubernetes service-account tokens, `~/.npmrc`, SSH keys and Claude Code session logs. It exfiltrates over the Session P2P network (`*.getsession.org`) and through GitHub dead-drop commits. It republishes the victim's own packages, forging Sigstore attestations, and plants persistence in `.claude/settings.json` and `.vscode/tasks.json`. A `gh-token-monitor` dead-man's switch runs `rm -rf ~/` if its token is revoked. TeamPCP claimed the attack.

## Who is affected

[GHSA-g7cv-rxg3-hmpx](https://github.com/advisories/GHSA-g7cv-rxg3-hmpx) (CVE-2026-45321, CVSS 3.1 9.6) lists all 42 packages with their patched versions. Examples: `@tanstack/react-router` is fixed in 1.169.9, `@tanstack/react-start` in 1.167.72 and `@tanstack/router-plugin` in 1.167.42. The GHSA shows each affected span as a range, but the malicious publishes were two versions per package, such as 1.169.5 and 1.169.8. Query, Table, Form, Virtual and Store were clean. CISA added CVE-2026-45321 to the [KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) on May 27, 2026 and marks it as known to be used in ransomware campaigns. Per [The Hacker News](https://thehackernews.com/2026/05/mini-shai-hulud-worm-compromises.html), the worm also reached `@mistralai/mistralai`, `mistralai` 2.4.6 on PyPI, `guardrails-ai` 0.10.1, `@opensearch-project/opensearch` 3.5.3/3.6.2/3.7.0/3.8.0, UiPath and others. OX Security counted more than 170 packages across npm and PyPI. A variant of the same malware later powered the August 2026 ChainDrop worm.

## Do you really need to act?

Only if you resolved a bad version during its window. TanStack's versions were live for roughly two to four hours before deprecation and removal. Long-lived lockfiles and Bun installs (Bun skips lifecycle scripts by default) were mostly spared. If you did install one, this is a full host compromise with a destructive trap attached. The order of operations matters more than speed. Isolate the host, kill the dead-man's switch, then rotate. The deeper lesson for maintainers: provenance proves which workflow published a package, not that the workflow was honest.

## What to do now

1. Search lockfiles for the GHSA versions and for `github:tanstack/router#79ac49ee`. Run `npm ls @tanstack/react-router @tanstack/router-core --all`.
2. On any affected host, stop and delete `gh-token-monitor` first: `systemctl --user disable --now gh-token-monitor` on Linux, or `launchctl unload ~/Library/LaunchAgents/com.user.gh-token-monitor.plist` on macOS. Then remove the script. Image the machine if you need forensics.
3. Remove `.claude/router_runtime.js`, `.claude/setup.mjs`, `.vscode/setup.mjs` and the hook entries, plus any `.github/workflows/codeql_analysis.yml` you did not write.
4. Rotate npm tokens and OIDC trusted-publisher grants, then GitHub PATs, cloud keys, Vault and Kubernetes tokens, SSH keys, and anything pasted into Claude Code sessions.
5. Block `*.getsession.org`, `api.masscan.cloud` and `git-tanstack.com` at DNS or egress.
6. Maintainers: pin trusted publishing to a specific workflow and `refs/heads/main`, grant `id-token: write` only to the publish job, never build fork code under `pull_request_target`, and purge Actions caches.

## How to tell if you were hit

Look for `router_init.js` (SHA-256 `ab4fcada…1266c`) or `tanstack_runner.js` in `node_modules/@tanstack`. Other signs: commits authored by `claude@users.noreply.github.com`, branches matching `dependabout/…/setup-formatter`, npm tokens described "IfYouRevokeThisTokenItWillWipeTheComputerOfTheOwner", DNS lookups of `filev2.getsession.org`, and public repos described "Shai-Hulud: Here We Go Again". For the PyPI variants, look for `/tmp/transformers.pyz`.

## Timeline

- May 10, 2026 — Attacker forks TanStack/router and stages a malicious commit.
- May 11, 2026 — Cache poisoned at 11:29 UTC; 84 malicious versions published at 19:20-19:26; StepSecurity reports at 19:46; GHSA published and tarballs removed by 23:55.
- May 12, 2026 — Spread to Mistral, Guardrails AI, OpenSearch, UiPath and others is reported.
- May 15, 2026 — TanStack issues an all-clear for all currently published versions.
- May 27, 2026 — CISA adds CVE-2026-45321 to KEV (due date June 10).

## Sources

1. [TanStack — npm supply chain compromise postmortem](https://tanstack.com/blog/npm-supply-chain-compromise-postmortem)
2. [GitHub Advisory — GHSA-g7cv-rxg3-hmpx](https://github.com/advisories/GHSA-g7cv-rxg3-hmpx)
3. [Snyk — TanStack npm packages hit by Mini Shai-Hulud](https://snyk.io/blog/tanstack-npm-packages-compromised/)
4. [CISA — Known Exploited Vulnerabilities Catalog (CVE-2026-45321)](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
5. [The Hacker News — Mini Shai-Hulud worm compromises TanStack, Mistral AI, Guardrails AI and more](https://thehackernews.com/2026/05/mini-shai-hulud-worm-compromises.html)

---
Source page: https://erroneo.us/security/briefs/mini-shai-hulud-tanstack-npm-worm/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt