TanStack NPM Packages Compromised: A Security Threat
- TanStack NPM packages were compromised due to a security breach.
- The breach allowed attackers to publish malicious code.
- Users are advised to be cautious when revoking tokens.
The Buzz Score
The Internet’s Verdict: 70% Hyped, 30% Skeptical
Forum Voices
Users are expressing concern about the security of NPM packages.
Please be careful when revoking tokens. It looks like the payload installs a dead-man’s switch at ~/.local/bin/gh-token-monitor.sh as a systemd user service (Linux) / LaunchAgent com.user.gh-token-monitor(macOS). It polls api.github.com/user with the stolen token every 60s, and if the token is revoked (HTTP 40x), it runs rm -rf ~/.
Some users are calling for increased security measures.
It is unfortunate, but this is evidence (IMO) that Trusted Publishing is still not enough by itself to securely publish from CI, as an attacker inside your CI pipeline or with stolen repo admin creds can easily publish.
Post Mortem
TanStack has released a postmortem report on the incident.
We (TanStack) just released our postmortem about this.
Focus Keyword: NPM Security
