Skip to content

TanStack compromise attacker

Named by 2 kept items in this workspace.

Search every workspace for TanStack compromise attacker. It matches the name as written, so it can find other things that share it.

The items that name it 2

  • Socket: actions/checkout v7 Blocks Unsafe pull_request_target Checkouts
    article2026-06-22

    Chained a pull_request_target pwn request with GitHub Actions cache poisoning across the fork-to-base repository boundary and runtime extraction of an OIDC token from the GitHub Actions runner process; published 84 malicious versions across 42 @tanstack/* packages without stealing a long-lived npm t

  • Socket: Mini Shai-Hulud
    article2026-05-22It is written here as TanStack compromise attacker(s).

    Attackers who on May 11 compromised 42 TanStack npm packages (84 malicious versions total) via a chained exploit: pull_request_target 'Pwn Request' abuse, GitHub Actions cache poisoning, and runtime extraction of an OIDC token from the runner's process memory; authenticated malicious publishes throu

All threat actors in this workspace.