Signed, sealed, delivered, infected

You might have seen the headlines about TanStack’s npm packages getting compromised. 84 malicious versions across 42 packages, then it spread to Mistral AI, UiPath, OpenSearch, Guardrails AI. Over 400 versions in total across npm and PyPI within hours. It’s bad. But there are a few things about this attack that make it worse than the usual supply chain drama, and I think they’re worth unpacking.

First, the technical chain is genuinely clever. The attackers (TeamPCP, same group that hit Bitwarden and SAP earlier this year) exploited three things in sequence: a pull_request_target misconfiguration in TanStack’s GitHub Actions, cache poisoning across the fork-to-base-repo boundary, and then (this is the wild part) they read the OIDC token straight out of the runner’s process memory via /proc/<pid>/mem. That token was meant for npm’s trusted publishing system. So the malicious packages were published from TanStack’s own CI pipeline, carrying valid SLSA Build Level 3 provenance attestations. They looked cryptographically authentic. Provenance as a trust signal just broke.

Second, the worm doesn’t clean up when you uninstall the package. It writes itself into .claude/ hooks and .vscode/tasks.json, so every time you open VS Code or run Claude Code, it fires again. It also drops a system daemon (com.user.gh-token-monitor on macOS, gh-token-monitor.service on Linux) that survives reboots. The threat actor reportedly taunted researchers with a YouTube link and a message saying “We’ve been online over 2 hours now stealing creds.”

And the exfiltration? It goes over the Session P2P network. Encrypted messenger traffic that looks like Signal, routed through a decentralized swarm. No central domain to take down.

If you or your team pulled any @tanstack/*, @uipath/*, @mistralai/*, or @opensearch-project/* packages between May 11-12, rotate everything. Not just npm tokens. GitHub PATs, AWS keys, Vault tokens, Kubernetes service accounts, SSH keys. And check for those .claude/ and .vscode/ files. They don’t go away with npm uninstall.

Anyway. Full writeup with all the IoCs and affected version ranges here if you want the details. I mostly wanted to flag the persistence and provenance angle because those aren’t getting enough attention.