An attacker published 84 malicious versions across 42 `@tanstack/*` packages to the npm registry. The attack was executed by chaining a `pull request target` misconfiguration, GitHub Actions cache poisoning, and runtime memory extraction of an OIDC token from the Actions runner process to publish malware under a trusted identity. This resulted in the distribution of a self-propagating credential-stealing worm.
Upon installation, the malware executes an obfuscated JavaScript file named `router init.js` (approximately 2.3 MB) located at the package root. This payload harvests sensitive data from AWS instance metadata (IMDS), GCP metadata services, Kubernetes service-account tokens, HashiCorp Vault tokens, `~/.npmrc` npm tokens, GitHub tokens, and SSH private keys. The stolen data is exfiltrated via the Session/Oxen messenger network using endpoints such as `filev2.getsession.org` and `seed{1,2,3}.getsession.org`.
Additionally, the worm can establish persistence in Claude Code and Microsoft Visual Studio Code (VS Code), install a `gh-token-monitor` service to steal GitHub tokens, and deploy malicious GitHub Actions workflows to exfiltrate repository secrets to `api.masscan.cloud`. It also attempts to spread by identifying other packages maintained by the victim and republishing them with the same injection. Tens of thousands of systems are estimated to be compromised.