TanStack Mini Shai-Hulud (CVE-2026-45321)

T0147 · Reconnaissance · Scan public CI/CD configurations for secrets and vulnerable actions

The publish path was a public GitHub Actions workflow that could be
chained (pull_request_target and cache poisoning).

T0122 · Initial Access · Vulnerability in third-party CI/CD actions

TanStack traced the compromise to a chained GitHub Actions attack
involving pull_request_target and Actions cache poisoning.

T0202 · Persistence · Inadequate CI/CD workflow permissions

The workflow identity could publish packages; poisoned cache plus
privileged pull_request_target made that durable.

T0109 · Resource Development · Publish malicious artifact

84 versions across 42 @tanstack packages were published to npm.

T0121 · Resource Development · Compromised legitimate artifact

Consumers of the real @tanstack scope received the poisoned versions.

T0158 · Initial Access · Vulnerable CI/CD template

A reusable/privileged workflow pattern (pull_request_target) was the
injection template, not a one-off script.

T0151 · Execution · Installation scripts

An optional GitHub-hosted dependency used a prepare lifecycle hook
(Bun) to run the JavaScript payload.

T0159 · Execution · Malicious artifact execution

Installing an affected version ran the credential stealer.

T0140 · Credential Access · Harvest tokens from environment variables

Cloud, GitHub, and CI secrets in the process environment were stolen.

T0193 · Collection · Sensitive information in environment variables

The stealer profiled the environment and collected tokens sitting in env.

T0168 · Exfiltration · Exfiltration to code repositories

Stolen data was committed to attacker-controlled GitHub repositories
via the GraphQL API using stolen tokens.

T0154 · Initial Access · Malicious IDE extension

Persistence hooks were installed into Claude Code and VS Code so the
stealer re-ran on IDE launch.

T0152 · Execution · IDE

Re-execution was tied to IDE launch, not only to npm install.

T0166 · Execution · Trigger pipeline execution

Injected GitHub Actions workflows serialized repository secrets and
uploaded them.

T0183 · Credential Access · Harvesting short-lived token

GitHub Actions OIDC / job tokens and short-lived cloud creds were in
the harvest set.

T0169 · Lateral Movement · Push implants across repositories

Injected GitHub Actions workflows and stolen tokens were used to
persist across repositories the victim could write.

T0186 · Impact · Source code leak

CrowdSec later attributed a copy of ~170 private repositories to a
laptop infected in this wave.

T0201 · Impact · Customers compromised

Downstream organizations (OpenAI, CrowdSec, Mistral AI, others) were
the realized victims of the poisoned packages.