npm's brutal year: the TanStack compromise and the ChainDrop worm
An attacker chained a pull_request_target workflow into 84 malicious TanStack versions, and a worm planted persistence in editor and AI tool config.
What to do
Audit every pull_request_target workflow you own this week, and review .claude/, .vscode/tasks.json and MCP config changes in pull requests as carefully as CI workflow files.
- May 11: 84 malicious versions across 42 @tanstack/* packages went out in six minutes. The attacker chained a pull_request_target workflow, GitHub Actions cache poisoning, and a publish-capable OIDC token pulled from the CI runner's memory. An outside researcher spotted it about 26 minutes later.
- August 4: the "ChainDrop" worm compromised more than 400 packages, including keyv, flat-cache and cache-manager. It stole npm, GitHub, AWS, Kubernetes and Vault credentials and planted persistence in .claude/settings.json and .vscode/tasks.json.
That last detail matters. Attackers now treat your editor and AI coding tool config as a place to run code.