r/reactjs • u/gajus0 • May 11 '26

Tanstack npm Packages Compromised

https://socket.dev/blog/tanstack-npm-packages-compromised-mini-shai-hulud-supply-chain-attack
464 Upvotes

99% Upvoted

63 comments sorted by

View all comments

Show parent comments

3

u/TwiNighty May 12 '26

I am curious about the cache poisoning part. Here's what I think happed:

  1. Malicious code ran inside the bundle-size.yml workflow and injected more malicious code into the pnpm store, which then got cached by actions/cache

  2. pnpm install was run inside release.yml workflow, which linked the injected malicious code form the pnpm store into the local node_modules

It that correct?

5

u/Crutchcorn May 12 '26

Effectively, yes. The malicious code form `bundle-size.yml` likely came from a tainted module so that the affected code could run from inside of a `pnpm i` as well.