TanStack npm Worm Compromises 170+ Packages and Breaches 3,800 GitHub Internal Repos

At 19:20 UTC on May 11, 2026, the TeamPCP threat group published 84 malicious package versions across 42 @tanstack/* npm packages in six minutes. By the time an external researcher flagged the anomaly — 20 to 26 minutes later — the worm had already begun propagating to PyPI and downstream tooling.

The attack chain is worth understanding in full. The initial vector was a pull_request_target Pwn Request — a well-documented GitHub Actions misconfiguration that allows forked pull requests to access repository secrets. Combined with GitHub Actions cache poisoning and OIDC token extraction, the worm gained enough access to publish poisoned packages autonomously, without human operator involvement after the initial trigger.

Phase two is where the breach escalated. The same campaign pushed a malicious version of the Nx Console VS Code extension — version 18.95.0 — on May 18 at 12:30 UTC. The extension was live for 18 minutes before being pulled at 12:48 UTC. In that window, any developer who had automatic extension updates enabled received a credential stealer that targeted:

• 1Password vaults
• Anthropic Claude Code configuration files (including session tokens)
• npm auth tokens
• GitHub personal access tokens
• AWS IAM credentials

GitHub has confirmed that 3,800 internal repositories were accessed using credentials harvested through this chain. Confirmed external victims include OpenAI, Mistral AI, UiPath, Guardrails AI, OpenSearch, and Grafana Labs. The total across npm and PyPI reached 170+ compromised packages and over 400 malicious published versions.

What developers need to do now:

If you had the Nx Console extension installed and automatic updates enabled as of May 18, treat all credentials stored in the targeted systems as compromised. Rotate:

• All npm publish tokens
• All GitHub tokens and OAuth apps
• All AWS IAM access keys used in CI/CD
• Any 1Password vault items accessible from your dev machine
• Claude Code session files (~/.claude/ directory)

Check your VS Code extension history under Extensions: Show Installed Extensions → ... → Show Extension Update History to verify whether version 18.95.0 was ever installed.

The @tanstack/* packages were cleaned and re-published by the maintainers. Verify you are running the latest clean versions before your next install or deploy. The TanStack team has published a detailed postmortem at their blog.

The systemic lesson is one the security community has repeated since the event-stream incident in 2018: trusted package namespaces are high-value targets precisely because of the trust developers extend to them without inspection. TanStack packages are installed in millions of JavaScript projects. A 6-minute publish window was enough to reach that entire population.

The GitHub pull_request_target misconfiguration that enabled this attack is not obscure. GitHub has documented it as a known risk pattern. Audit your CI workflows this week.