In May 2026, TanStack Router — one of the most-used routing libraries in the React ecosystem, roughly 12 million downloads a week — got compromised through a four-hop chain. Nothing in it was individually a zero-day. Together, it produced 84 malicious package versions across 42 packages, published with fully valid cryptographic provenance.
Hop 1 — pull_request_target
An attacker forked the repo and merged a malicious commit. A workflow triggered on pull_request_target then checked out and ran code straight from that fork — a well-known dangerous pattern when the checkout ref isn't restricted.
Hop 2 — Cache poisoning
That code poisoned the GitHub Actions cache with a malicious package store, then waited.
Hop 3 — OIDC extraction from runner memory
Hours later, a routine workflow restored the poisoned cache. A binary then extracted OIDC tokens directly from the runner's memory — using the exact same script, with the same code comment, as the tj-actions/changed-files compromise from March 2025. Different repository, different year, same tool reused by (likely) different actors.
Hop 4 — Publish with valid provenance
Those tokens published 84 malicious versions — with valid, cryptographically verified SLSA provenance attached. No npm token was ever stolen; the credentials were real, just in the wrong hands.
The response — and the trap
An independent researcher caught it in 20–26 minutes; the packages were deprecated within the hour. Buried in the payload was a persistence daemon that polled for its own token's revocation status — and was set to wipe the machine the moment that token got rotated. Fast detection is likely why that trigger was defused before standard incident-response steps (rotate the leaked credential) could set it off.
The takeaway
A finding is one fact: a leaked token, a mutable cache, a transitive dependency. A chain is what happens when three or four unremarkable facts line up in the right order — and increasingly, attackers are reusing each other's tooling across incidents more than a year apart, not just the same techniques.
Episode 5 of They Read The Manual walks through the full chain, including the exact GitHub Actions configuration involved and a 60-second check you can run against your own workflows.
🎥 Watch: https://youtu.be/DWk08WslyfE
