Worm-Like npm Supply-Chain Attack Compromises More Than 50 Packages
Summary
More than 50 npm packages across several namespaces were compromised with malware that steals GitHub credentials and AWS secrets, then uses stolen credentials to publish malicious package versions.
Key points
- Compromised versions span the @tanstack, @mistralai, @uipath, @squawk, and safe-action namespaces.
- Install scripts download the Bun runtime and execute a payload that harvests GitHub credentials using `gh auth token`.
- The malware contacts the lookalike domain git-tanstack.com for command and control.
- It queries AWS instance metadata and attempts to expand access through STS and SSM across multiple regions.
- Stolen credentials are used to publish malicious versions of additional packages; the article describes the campaign as worm-like.
- Users of affected versions are advised to investigate suspicious activity, rotate GitHub credentials, and audit accessible AWS credentials.
- The Bun binary is deleted after execution to reduce forensic traces.
Article Details
- Event Type
- Supply-chain compromise involving more than 50 malicious npm package versions across multiple namespaces. The packages execute an infostealer and use stolen credentials to publish further compromised packages.
- Impact
- The packages harvest GitHub credentials and cloud secrets. On AWS, the payload queries instance metadata and attempts to use role credentials with STS and SSM to expand account access. Users who installed affected versions are advised to check for suspicious activity, rotate GitHub credentials, and audit accessible AWS credentials.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | git-tanstack[.]com | Lookalike domain identified as the malware's primary C2. |
| SHA256 | 2ec78d556d696e208927cc503d48e4b5eb56b31abc2870c2ed2e98d6be27fc96 | Hash of the malicious tanstack_runner.js payload. |
Products
AWSUsers who have installed any of the affected versions should check for suspicious activity, rotate their GitHub credentials, and audit any AWS credentials accessible from machines where the packages were installed.GitHubbeen compromised and use a classic drop-and-execute attack pattern to run an infostealer that harvests GitHub credentials and cloud secrets.npmThe npm packages @tanstack/history (1.161.9, 1.161.12) and more than 50 other packages across the @tanstack, @mistralai, @uipath, @squawk, and safe-action namespaces have been compromised and use a classic