Hackers hijacked 42 npm packages in six minutes by poisoning GitHub Actions pipelines

On May 11 between 19:20 and 19:26 UTC, attackers compromised 42 TanStack npm packages and published 84 malicious versions by exploiting GitHub Actions cache poisoning and unsafe workflow permissions without ever stealing npm credentials directly.

The malware, which ran automatically on package installation, harvested cloud credentials from AWS, GCP, Kubernetes, GitHub, SSH keys, and npm configs from developer machines and CI environments, then attempted to self-propagate to other packages maintained by affected developers.

External security researchers detected the breach within roughly 20 minutes; TanStack has since removed unsafe workflow patterns, pinned GitHub Actions to immutable SHAs, purged caches, added stricter publishing controls, and acknowledged that it learned of the attack from outside researchers, not its own monitoring.

For developers and engineering teams building on open source tooling, particularly those using GitHub Actions for automated deployments, this attack confirms that CI/CD pipelines are now a primary target, not an afterthought.

Any team running pull_request_target workflows or relying on shared GitHub Actions caches without strict isolation should audit those configurations in the next 30 days, as the attack pattern used here requires no stolen passwords and leaves few obvious traces.

Over the next 6–12 months, enterprises and funded startups in Lagos and across Africa that are scaling engineering teams and adopting cloud-native infrastructure will face growing exposure to supply-chain attacks as their dependency footprints expand.