Horizon Alert
Summary of the vulnerability and why it matters
Malicious code was published to the npm registry disguised as legitimate updates for the @tanstack/* packages. This incident involved a sophisticated supply chain attack that leveraged vulnerabilities in GitHub Actions and package publishing to inject credential-stealing malware under a trusted identity, impacting multiple development tools.
- Malicious code disguised as trusted updates.
- Supply chain attack compromised trusted developer tools.
- Confirm relevance and potential exposure to affected code.
Attack Path
How an attacker could exploit the issue
Attackers exploited a vulnerability in the GitHub Actions workflow to publish malicious versions of TanStack packages to the npm registry. This attack chained multiple vulnerabilities, including a `pull_request_target` misconfiguration and cache poisoning, to steal credentials and distribute malware under a trusted identity.
- Entry condition: Access to a vulnerable GitHub Actions workflow.
- Trigger point: Publishing malicious code to the npm registry.
- Resulting risk: Credential theft and malware distribution.
Live Threat
Current exploitation, exposure, and threat context
The described vulnerability could allow malicious code to be published to the npm registry under a trusted identity. This occurs when specific conditions are met during the software development or build process, potentially impacting systems that use compromised packages.
- Malicious package versions could be installed.
- Compromised code could execute during builds.
- No direct impact to user data or PII is specified.
Operational Fix
Recommended remediation, mitigation, and detection steps
The supply chain attack on @tanstack/* packages necessitates immediate triage by platform and development teams to identify affected codebases and accountable owners. The first practical step involves confirming where these compromised packages are integrated into your development or build pipelines, assessing their business criticality, and then strategizing remediation based on the identified risk.
- Ownership: Platform and development teams.
- Verify first: Package integration in build pipelines.
- Action: Plan targeted remediation or removal.
