Executive Summary

On May 11^th between 19:20 and 19:26 UTC, an attacker published 42 malicious TanStack npm packages with multiple malicious versions per package. An aggregate download count of all the packages affected reaches in the tens of millions, increasing the severity of the attack substantially. These malicious package versions targeted Continuous Integration Continuous Delivery (CI/CD) systems to steal build and production environment credentials across multiple services and continue to publish additional malicious packages. Malicious payloads from this attack targeted credentials from AWS, GCP, Kubernetes, Vault, Github, npm, pip, SSH, commercial VPN configurations, messaging applications, and cryptocurrency wallets. At the time of writing, at least three other libraries were affected by similar malware, including Python pip and PHP Composer packages.

The initial malicious libraries published by TenStack to npm were identified as malware within the hour by Ashish Kurmi, an external researcher for StepSecurity. Tenstack removed and purged their Github cache entries within two hours of the initial compromise.

This malicious behavior mirrors many patterns within the recent Shai-Hulud attacks and is attributed to TeamPCP. The attack exacerbates the trend of the group targeting victim CI/CD dependencies to hit developers. This attack specifically targets the Github OpenID Connect (OIDC) federation mechanism, which mints a new valid npm publish token on the compromised CI identity. This ensures affected packages have a “verified provenance” badge in npm, commonly used to delineate rouge package deployments, and ensures that a CI/CD publish step does not need to complete for the worm to propagate.

Organizations that are affected should immediately audit installed packages to confirm whether any of the affected libraries were installed. If so, treat the machine as compromised and follow the Mitigations and Workarounds below.

Affected Systems or Products

Mitigations / Workarounds

If you believe that a machine has already been impacted, assume all secrets that are accessible on the affected host are compromised. We do not advise cleaning in place and instead recommend reimaging or rebuilding affected machines from known good images.

Any credentials related to AWS, GCP, Kubernetes, Vault, Github, NPM, Pip, or SSH on a host with an affected version should be rotated immediately. Any keys that match the following regex should be considered compromised and exfiled:

• 

  /npm_[A-Za-z0-9]{36,}/g

• 

  /gh[op]_[A-Za-z0-9]{36}/g

• 

  /hvs\.[A-Za-z0-9_-]{24,}/g

• 

  /eyJhbGciOiJSUzI1NiIsImtpZCI6[\w\-.]+/g

• 

  /AKIA[0-9A-Z]{16}/g

The following hard-coded paths for files are enumerated by the payload and any instances of these credentials are assumed to be compromised as well. These paths include credentials more commonly found on developer machines rather than purely CI/CD pipelines:

• 

  ~/.azure/accessTokens.json

• 

  ~/.config/gcloud/*

• 

  ~/.kube/config

• 

  /var/run/secrets/kubernetes.io/serviceaccount/token

• 

  ~/.terraform.d/credentials.tfrc.json

• 

  /etc/rancher/k3s/k3s.yaml

• 

  /var/lib/docker/containers/*/config.v2.json

• 

  ~/.bash_history

• 

  ~/.zsh_history

• 

  ~/.python_history

• 

  ~/.mysql_history

• 

  ~/.ssh/id_rsa

• 

  ~/.ssh/id_ed25519

• 

  ~/.ssh/id_ecdsa

• 

  ~/.git-credentials

• 

  ~/.gitconfig

• 

  .vscode/tasks.json

• 

  .vscode/setup.mjs

• 

  ~/.npmrc

• 

  ~/.pypirc

• 

  ~/.docker/config.json

• 

  ~/.netrc

• 

  ~/.yarnrc

• 

  ~/.claude.json

• 

  ~/.claude/mcp.json

• 

  ~/.kiro/settings/mcp.json

• 

  ~/.bitcoin/wallet.dat

• 

  ~/.ethereum/keystore/*

• 

  ~/.monero/*

• 

  ~/.zcash/wallet.dat

• 

  ~/.config/Signal/*

• 

  ~/.config/Slack/Cookies,

• 

  ~/.config/discord/*

• 

  ~/.config/telegram-desktop/*

It’s been identified by Github user @carlini that revocation of Github tokens will trigger a wipe of the home directory of the current user via rm -rf ~/. This affects developer machines much more than CI/CD pipelines.

For endpoints and developer machines, ensure that the affected packaged are not installed on the host:

find / \( -name "package-lock.json" -o -name "pnpm-lock.yaml" -o -name "yarn.lock" \) -exec sh -c ' grep -E "@agentwork-cli|@beproduc|@cap-j|@dirigible-a|@draftaut|@draftla|@mesade|@mistrala|@ml-toolkit-t|@opensearch-projec|@squaw|@supersurkhe|@tallyu|@tanstac|@taskflow-cor|@tolk|@uipath|" "$1" | grep "node_modules" && echo " ^^ found in: $1" ' _ {} \; 

Ensure that the payload is not installed on any suspected hosts:

find / ((-name "package-lock.json" -o -name "pnpm-lock.yaml" -o -name "yarn.lock") -o ( -path "

Additionally, persistence mechanisms appear in Linux and macOS under the name gh-token-monitor within systemd and launchctl respectively. Using pinned versions of libraries is recommended to prevent this kind of attack if new malicious versions are released for any library.

Using pinned versions of libraries is recommended to help mitigate these attacks in the future. NPM specifically offers a configuration, npm config set min-release-age 3, that will enforce a 48-72 hour period on new package releases before installing them on your machine. This is advised for all developers using external npm packages. For machines running without human interaction, such as CI/CD pipelines, we advise not only version pinning of packages but disabling scripts on installs with the –ignore-scripts argument wherever possible. Python’s and PHP’s package managers don’t advise globally updating all packages regularly and therefore are less likely to be unpinned and installed each CI/CD invocation, so no such mechanism exists within the respective package managers.

Patches

While not strictly a patch, ensuring that any installed affected npm, pip, and conductor packages are removed and purged from your machines is recommended. This involves removing the affected packages and installing pinned versions of the unaffected packages.

Indicators of Compromise

How Beazley Security is responding

Beazley Security is conducting threat hunts across our MDR environment to detect potential exploitation attempts against our clients.

If you believe your organization may have been impacted by this attack campaign and need support, please contact our Incident Response team.

Sources

• 

  https://github.com/TanStack/router/issues/7383

• 

  https://www.stepsecurity.io/blog/mini-shai-hulud-is-back-a-self-spreading-supply-chain-attack-hits-the-npm-ecosystem

• 

  https://tanstack.com/blog/npm-supply-chain-compromise-postmortem

• 

  https://socket.dev/blog/tanstack-npm-packages-compromised-mini-shai-hulud-supply-chain-attack