The TanStack npm Attack: How TeamPCP Compromised 42 Packages
Date Observed: May 11, 2026Ecosystem: npm, PyPITargets: Developers using @tanstack/react-router and related packages; UiPath, Mistral AI, OpenSearch, and Guardrails AI usersAttack Type: GitHub Actions cache poisoning, OIDC token extraction from runner memory, npm worm self-propagationImpact: 84 malicious package versions across 42 @tanstack/* npm packages; PyPI packages also compromised; credentials stolen from GitHub, AWS, GCP, Kubernetes, […]