TeamPCP-Attributed Shai-Hulud Campaign Uses Stolen OIDC Tokens to Publish Malicious Packages
Summary
A Shai-Hulud campaign attributed to TeamPCP used stolen OIDC tokens and CI/CD credentials to publish malicious packages across npm, PyPI and Composer, stealing developer secrets and establishing persistence.
Key points
- Security vendors reported hundreds of compromised package artifacts across npm, PyPI and Composer, with counts varying by source.
- A TanStack post-mortem says attackers chained a risky GitHub Actions workflow, cache poisoning and OIDC token theft; 84 malicious versions across 42 TanStack packages carried valid provenance and signatures.
- Attackers reportedly used an orphaned Git commit accessible through GitHub’s shared fork storage and a malicious optional dependency to trigger code during package installation.
- The malware targeted developer secrets including GitHub, npm, AWS, Kubernetes, Vault and SSH credentials; researchers said it also read GitHub Actions process memory.
- The malware reportedly used the Session P2P network to exfiltrate information and created Claude Code hooks and VS Code auto-run tasks for persistence.
- Researchers advised checking affected package versions and developer machines, rotating exposed credentials, auditing IDE directories and adding behavioral checks at install time.
Article Details
- Attack Vectors
- The attackers reportedly chained a risky pull_request_target workflow, GitHub Actions cache poisoning, and theft of OIDC tokens from runner memory to publish malicious packages through legitimate CI/CD pipelines.
- A malicious optional dependency referenced an orphaned commit in a TanStack/router fork, causing npm to fetch and execute attacker-controlled code during package installation.
- The malware collected developer credentials, including GitHub and npm tokens, cloud credentials, Kubernetes tokens, Vault tokens, SSH keys, and .env files, then exfiltrated data through the Session P2P network.
- For self-propagation, the malware used stolen GitHub/npm credentials to enumerate packages associated with compromised maintainers, modify package tarballs, and republish malicious versions.
- After infection, the malware reportedly persisted through Claude Code hooks and VS Code auto-run tasks.
- Defensive Notes
- Check for affected package versions and persistence on developer machines; audit IDE directories for malicious files such as router_runtime.js or setup.mjs.
- Assume credentials were exposed after downloading an affected package, and rotate GitHub, npm, AWS, Vault, Kubernetes service-account, and CI/CD credentials.
- Block the reported command-and-control infrastructure at DNS or proxy level.
- Verify package provenance and add behavioral analysis at install time, alongside signature-based checks for malicious packages.
- Consider enforcing lockfile-only installs to prevent automatic or silent package updates.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | api[.]masscan[.]cloud | Listed as threat-actor command-and-control infrastructure to block. |
| DOMAIN | git-tanstack[.]com | Listed as threat-actor command-and-control infrastructure to block. |
MITRE ATT&CK
T1059.007 · JavaScriptA malicious optional dependency caused npm to fetch and execute attacker-controlled code during installation; the article identifies JavaScript payload files including router_runtime.js and setup.mjs.T1078 · Valid AccountsThe campaign used stolen GitHub and npm credentials to enumerate maintainers’ packages and publish malicious versions.T1195.002 · Compromise Software Supply ChainAttackers published malicious versions of npm packages through compromised software supply-chain workflows.T1528 · Steal Application Access TokenThe attackers stole GitHub Actions OIDC tokens and other application tokens, including GitHub and npm credentials.T1546 · Event Triggered ExecutionThe malware reportedly persisted by writing itself into Claude Code hooks and VS Code auto-run tasks.T1552.001 · Credentials In FilesThe payload collected credentials from developer files, including .env files and other file paths.
Threat Actors
Products
Claude CodeClaude Code configsGitHub ActionsAccording to TanStack’s post-mortem report from TanStack, the attackers chained three vulnerabilities: a risky ‘pull_request-target’ workflow, GitHub Actions cache poisoning, and OIDC token theft from runner memory.npmHundreds of packages across npm, PyPI, and Composer were compromised in the Shai-Hulud supply-chain campaign, which used stolen OIDC tokens to publish malicious versions with valid SLSA Build Level 3 provenance.VS CodeVS Code tasks