A Single PR Just Hijacked the NPM Registry...

Why It Matters

The incident shows that CI workflow misconfiguration can allow ephemeral token-based publishing protections to be bypassed, turning a single PR into a wide-ranging supply-chain compromise with ransomware-like destructive potential. Organizations and maintainers must harden CI triggers, adopt safer package managers and enforce stricter dependency and build policies to reduce systemic risk.

Summary

A sophisticated supply-chain attack compromised over 100 npm packages tied to TanStack and then spread to hundreds more within hours by exploiting GitHub Actions’ pull_request_target workflow and GitHub’s signed CI tokens. The attacker forked the repo, opened and closed a PR to execute the main repo’s workflow with elevated permissions, planted a poisoned file in the CI cache, then later used it to steal ephemeral npm publish tokens and push malicious releases that harvested credentials and propagated to other projects. The worm quickly infected packages from major maintainers (including Mistral AI, UiPath and others), forged commits to evade detection, persisted in developer environments and included a destructive “dead-man” payload that wipes systems if stolen tokens expire. Security researchers tracked hundreds of poisoned versions across dozens of packages, and mitigations like PNPM’s minimum release age, blocking exotic sub-dependencies and approved builds could have limited the impact.

Original Description

Try Seer Agent for free - https://sentry.io/fireship. It uses all of Sentry's context on your app to investigate production issues for you.

Earlier this week Tanstack was poisoned with a sophisticated supply chain attack . In this video we break down how it happened and how you can protect yourself in the future.

#coding #programming

Want more Fireship?

🗞️ Newsletter: https://bytes.dev

🧠 Courses: https://fireship.dev