A new variant of the Shai-Hulud npm worm has targeted the TanStack ecosystem with a malicious payload designed to steal credentials and destroy user data. The attack occurred on May 11, 2026, between 19:20 and 19:26 UTC, when an attacker published 84 malicious versions across 42 TanStack npm packages.

The cybersecurity incident was detected within 20 minutes by an external researcher. The malware, stripped of three layers of obfuscation, contains a threatening sigil string: IfYouRevokeThisTokenItWillWipeTheComputerOfTheOwner. This is not merely psychological intimidation. The payload executes rm -rf ~/ on a developer’s machine if the stolen GitHub token is revoked.

How the Attacker Accessed TanStack’s Release Pipeline

The entry point was not a stolen maintainer credential. Instead, the attacker exploited a pull_request_target pattern combined with GitHub Actions cache poisoning. The technique allowed a malicious pull request on a forked repository to influence code execution inside a trusted workflow run. An OIDC token was extracted at runtime from the GitHub Actions runner process memory.

Notably, no npm tokens were stolen directly. However, the malware performs credential harvesting on every installation host, extracting secrets from environment variables, .npmrc files, .git-credentials, browser session stores, cloud CLI configurations, and GitHub Actions runner memory via /proc//mem.

Shai-Hulud npm worm Payload Behavior

When a trojanized package is installed, the dropper executes multiple malicious functions. First, it downloads the Bun runtime to a temporary directory if Bun is not already present on the system. This approach bypasses Node-native modules and certain EDR detection rules.

The malware then steals secrets and encrypts them using a hybrid scheme: a fresh 32-byte AES-256-GCM key encrypts the data, then RSA-OAEP-SHA-256 with a 4096-bit key wraps that encryption key to the operator’s public key. Encrypted dumps are published as public GitHub repositories under the victim’s account with themed names and the description “Shai-Hulud: Here We Go Again.”

Persistence is achieved through multiple mechanisms: a Claude Code SessionStart hook, VS Code tasks.json with runOn: folderOpen, a malicious CodeQL Analysis GitHub Actions workflow that exfiltrates secrets to api.masscan.cloud/v2/upload, and a launchd or systemd-user unit called gh-token-monitor that acts as a dead-man’s switch.

The Peer-to-Peer Token Relay Mechanism

The sigil string serves a dual purpose: it is both a threat and a technical marker for a peer-to-peer credential relay. After stealing a GitHub token, the malware makes one commit whose message contains IfYouRevokeThisTokenItWillWipeTheComputerOfTheOwner followed by a base64-encoded copy of the stolen token.

Infected machines search GitHub’s commit index using the exact phrase as a query parameter. This single public search query acts as a bulletin board where infected hosts exchange working GitHub tokens. No private command-and-control server is needed; GitHub’s own search index becomes the communication channel.

What Developers and Organizations Must Do

  • Disable automatic task execution in VS Code and Claude Code before opening untrusted repositories.
  • Search for the gh-token-monitor persistence unit under ~/Library/LaunchAgents (macOS), ~/.config/systemd/user (Linux), or scheduled tasks (Windows) and remove it before revoking any tokens.
  • Rotate every GitHub token that touched any infected host via github.com/settings/tokens and organizational SSO.
  • Block egress to api.masscan.cloud at the firewall; it is the hardcoded exfiltration endpoint.
  • Search organizational repositories for workflows containing toJSON(secrets) written to a file and curled out.
  • Search personal and organizational accounts for repositories with the description “Shai-Hulud: Here We Go Again” or themed three-word names drawn from Dune lore, such as tleilaxu-lasgun-263.
  • Report active infections to GitHub Trust & Safety at support.github.com/contact/report-abuse.

For projects that depend on any TanStack packages, pin to versions published well before May 11, 2026. Purge node_modules and lockfiles, clear the npm cache, and rebuild. Treat any developer machine or CI runner that installed an affected version during the active window as compromised.

Indicators of Compromise and Detection

Network indicators include api.masscan.cloud as the hardcoded exfiltration endpoint, Session and Oxen messenger network nodes (filev2.getsession.org, seed1.getsession.org, seed2.getsession.org, seed3.getsession.org), npm registry calls enumerating maintainer packages, and outbound POST traffic from GitHub Actions runners carrying JSON bodies immediately after CodeQL Analysis workflows run.

GitHub source-control indicators include commit messages containing the exact string IfYouRevokeThisTokenItWillWipeTheComputerOfTheOwner, repositories with the description “Shai-Hulud: Here We Go Again,” repository names matching themed three-word patterns, commits authored as [email protected] where unexpected, bursts of generic commit messages creating dozens of new public repositories in a short window, and workflows with actions/checkout and actions/upload-artifact pinned by SHA in combination with steps echoing secrets.

Host-level artifacts include the file tanstack_runner.js in any package or repository, the gh-token-monitor persistence unit, Claude Code SessionStart hooks pointing at unexpected scripts, VS Code tasks.json files containing “runOn”: “folderOpen” with remote payloads, Python processes reading /proc//mem on GitHub Actions runners, and Bun binaries appearing in temporary directories on systems that do not ship Bun.

The malware payload uses specific cryptographic parameters: PBKDF2 password 0c0e873033875f1bc471eda37e3b9d0f9b89bd41a4bbb4f86746caa2176c40aa, salt svksjrhjkcejg, and 200,000 iterations. Two operator RSA-4096 public-key SHA-256 fingerprints have been observed: 166be2b7b58a440f7b17520ffb0368be5d89c76661704b4945417eb04b9ada65 and bf9370f22dc04ee80d4ab8f9a2adc7a900cb39d94c89f64ab3f3726589eac713.

The Cybersecurity Reach Foundation published this analysis on May 11, 2026. Evidence has been preserved and forwarded to relevant authorities. The report used artificial intelligence tooling to assist with reverse-engineering and payload de-obfuscation, with every technical detail verified against the actual payload before publication.

Source: Cybersecurity Reach Foundation