Ashishkurmi

**Name of the Vulnerable Software and Affected Versions** @tanstack/* packages (affected versions not specified) **Description** An attacker published 84 malicious versions across 42 `@tanstack/*` packages to the npm registry. The attack was executed by chaining three vulnerability classes: a `pull request target` misconfiguration (known as a Pwn Request), GitHub Actions cache poisoning across the fork-base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process. This allowed the attacker to publish credential-stealing malware under a trusted identity with valid SLSA Build Level 3 provenance attestations. Upon installation, the affected packages execute an obfuscated JavaScript file named `router init.js` that harvests sensitive data, including AWS, GCP, and Kubernetes credentials, GitHub and npm tokens, SSH private keys, and cryptocurrency wallets. The stolen data is exfiltrated via the Session/Oxen messenger network to endpoints such as `filev2.getsession.org`. The malware is self-propagating; it identifies other packages maintained by the victim and attempts to republish them with the same malicious injection. It can also establish persistence in Claude Code and Microsoft Visual Studio Code (VS Code) and install a service named `gh-token-monitor` to continuously steal GitHub tokens. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. Pin every `@tanstack/*` dependency to a known-good version published before 2026-05-11 19:00 UTC. Delete `node modules` and the lockfile, then reinstall to ensure no transitive dependency resolves to a malicious version. Configure npm to skip lifecycle scripts on install by setting `npm config set ignore-scripts true` as a temporary defense-in-depth measure. Rotate all credentials, secrets, and tokens accessible to any environment that ran an installation of `@tanstack/*` packages between 19:20 and 19:30 UTC on 2026-05-11.

Name of the Vulnerable Software and Affected Versions @usebruno/cli versions installed between 00:21 UTC and ~03:30 UTC on March 31, 2026 Description A supply chain attack involving compromised versions of the `axios` npm package introduced a hidden dependency deploying a cross-platform Remote Access Trojan (RAT). Users of `@usebruno/cli` who ran `npm install` during the affected time window may have been impacted, potentially leading to the execution of a malicious `postinstall` script, RAT installation, and exfiltration of credentials and sensitive data. Bruno desktop app users and those who installed outside the attack window were not impacted. The compromised `axios` versions (`1.14.1`, `0.30.4`) have been removed from npm. Recommendations If you installed @usebruno/cli during the affected window, reinstall dependencies. Rotate all credentials and secrets.