This threat involves a supply-chain attack on TanStack npm packages where attackers injected credential-stealing malware into 84 package artifacts. The malware includes a file named router_init.js with obfuscation and daemonization features, targeting CI/CD environments like GitHub Actions. Attackers leveraged GitHub Actions cache poisoning and pull_request_target patterns to steal OIDC tokens, which were then used to authenticate malicious npm publishes through trusted-publisher bindings. The malware collects credentials from multiple sources including GitHub Actions secrets, AWS IMDS, Secrets Manager, SSM, HashiCorp Vault, and Kubernetes, and persists in developer tools directories. Data exfiltration occurs via Session's decentralized P2P network. The campaign is ongoing and expanding, with self-propagation capabilities that steal npm OIDC tokens and republish compromised packages autonomously. No CVE or patch information is available, and no known exploits in the wild are reported.

The compromise affects widely used npm packages with millions of weekly downloads, potentially exposing numerous CI/CD pipelines and developer environments to credential theft. Stolen credentials include GitHub Actions secrets and cloud service tokens, which could lead to unauthorized access to cloud resources and further compromise. The malware's persistence in developer tools and autonomous republishing capabilities increase the risk of widespread supply-chain contamination. However, no confirmed active exploitation in the wild has been reported yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until official fixes or guidance are available, organizations should audit their CI/CD workflows for suspicious activity, especially GitHub Actions workflows using pull_request_target and cache features. Review and rotate potentially exposed secrets and tokens. Monitor for unusual npm package versions and consider using package integrity verification. Avoid trusting npm packages without verifying their provenance during this ongoing campaign.