Ongoing Supply Chain Attack Expands to PyPi

The software supply chain is facing another significant threat in the form of a widespread compromise across 84 npm package artifacts in the widely used tanstack namespace. The attack began on the npm platform but has since expanded to PyPi, as well.

This incident exposed high-volume packages, including pkg:npm/@tanstack/react-router, which has over 12 million weekly downloads. Researchers from Socket have linked the compromise to the "Mini Shai-Hulud" campaign, which has been ongoing for several weeks and is associated with the threat actor TeamPCP. That group has been systematically executing supply chain attacks for several weeks, targeting a long list of projects.  

This ongoing campaign began with a compromise of some of the TanStack packages and has since expanded to a number of others.

"The important part is not only the number of packages, but where they run. These packages are likely to be installed in local developer environments, CI jobs, release workflows, and internal build systems. That is exactly where npm tokens, GitHub tokens, cloud credentials, Kubernetes service account tokens, and deployment secrets tend to live," researchers at Aikido Security said.

The goal of the attack was the insertion of a suspected credential stealer designed to target various CI systems, notStackably Github Actions.The affected package versions contained a newly added, heavily obfuscated file named router_init.js. This file is approximately 2.3 MB and employs a distinct javascript-obfuscatorpattern, including string-array rotation, hex-encoded identifier lookups, and control-flow flattening—a signature far removed from standard minifier output.

Socket’s analysis of the malware showed that the payload has a range of malicious capabilities:

• CI Targeting: It attempts to access GITHUB_* environment variables, which often contain sensitive Actions/CI-only secrets, including tokens and actor identity.
• Persistence: It leverages spawn-based daemonization, utilizing a _DAEMONIZED re-entrancy guard and detached standard I/O.
• Exfiltration: It stages data in temporary directories with read/write/unlink lifecycles before performing remote streaming/dispatch operations.

The attacker injected the payload via a highly suspicious update to the package.json file in the recently published versions. An optionalDependencies field was added, pointing to a commit in the TanStack/router repository:

"optionalDependencies": {

  "@tanstack/setup": "github:tanstack/router#79ac49eedf774dd4b0cfa308722bc463cfe5885c"

}

The referenced commit, 79ac49eedf774dd4b0cfa308722bc463cfe5885c, was a standalone/root commit with no parent history. It introduced a package named @tanstack/setup that registered a prepare lifecycle hook executing bun run tanstack_runner.js && exit 1. Since npm automatically executes lifecycle hooks for git-based dependencies during installation, this allowed arbitrary code to run on developer workstations and CI systems.

“This latest activity shows the campaign continuing to propagate across both npm and PyPI, with affected packages spanning search infrastructure, AI tooling, aviation-related developer packages, enterprise automation, frontend tooling, and CI/CD-adjacent ecosystems,” the Socket analysis says. 

The compromise was traced to a chained GitHub Actions attack, which TanStack’s postmortem attributed to the pull_request_target "Pwn Request" pattern, GitHub Actions cache poisoning across the fork-to-base trust boundary, and runtime memory extraction of an OIDC token from the GitHub Actions runner process.

The TanStack team confirmed that no npm tokens were stolen, and the npm publish workflow itself was not compromised. Instead, the attacker-controlled code, running during the workflow’s test/cleanup phase, authenticated the malicious publishes through the project’s OIDC trusted-publisher binding, posting directly to the npm registry.

“All affected versions have been deprecated; npm security has been engaged to pull tarballs from the registry. We have no evidence of npm credentials being stolen, but we strongly recommend that anyone who installed an affected version on 2026-05-11 rotate AWS, GCP, Kubernetes, Vault, GitHub, npm, and SSH credentials reachable from the install host,” the TaStack team said in its post-mortem.

The suspicious commit was authored by the GitHub account voicproducoes, whose public activity, including projects named “A Mini Shai-Hulud has Appeared,” suggests the account was taken over and is part of the broader malware campaign.

Confirmed compromised artifacts include:

• npm: @opensearch-project/opensearchversions 3.5.3, 3.6.2, 3.7.0, and 3.8.0.
• npm (Squawk): @squawk/mcp@0.9.5, @squawk/weather@0.5.10, @squawk/flightplan@0.5.6, and related packages.
• PyPI (AI Tooling): mistralai@2.4.6and guardrails-ai@0.10.1.

The compromise of guardrails-ai@0.10.1is particularly alarming as the malicious code executes immediately upon import. The package checks for Linux systems, downloads a remote Python artifact from git-tanstack.com/transformers.pyz, writes it to /tmp/transformers.pyz, and executes it without integrity verification.

Further evidence linking the attacks to TeamPCP was found when the git-tanstack.com domain displayed a message signed "With Love TeamPCP," stating: "We've been online over 2 hours now stealing creds". 

TanStack has taken a number of actions, including deprecating affected versions, engaging npm security to pull malicious tarballs, purging GitHub Actions cache entries, and implementing hardening changes such as adding repository-owner guards and pinning third-party action references in their workflows.

The campaign remains highly active and organizations relying on open-source dependencies must remain vigilant, auditing dependencies and treating this and related campaigns as part of the persistent, evolving threat landscape. Socket is maintaining a running list of compromised packages in its blog.