Supply chain compromise affecting npm and PyPi ecosystems

Npm is the default package manager for Node.js, allowing you to install and manage essential libraries like TanStack, a suite dedicated to managing state and data manipulation in the React and JavaScript ecosystems. PyPi is the official repository of third-party software and libraries for the Python programming language and represents the source where Python developers publish and find modules intended for various uses such as data analysis, artificial intelligence, automation. On May 11, 2026, a malicious actor identified under the pseudonym TeamPCP published 42 malicious npm packages spread across 84 versions of the @tanstack/ space. This publication was made possible by the combination of three techniques: the exploitation of “Pwn Request” vulnerabilities via pull_request_target, the poisoning of the GitHub Actions cache and the extraction of an OIDC token in memory. The compromised versions incorporate two distinct infection vectors. An optionalDependencies field added in the package.json of affected packages automatically triggering the execution of a payload via the Bun executor upon installation. The packages also contain a heavily obfuscated file named router_init.js, which acts as a data collection agent and self-propagating worm. The spread of the worm led to the impact of other npm packages such as opensearch-project/opensearch, uipath as well as the PyPi packages mistralai and guardrails-ai. This compromise would allow a malicious actor to execute arbitrary code remotely, steal cloud service credentials and permanently compromise the integrity of affected environments.

• The compromised PyPi packages guardrails-ai@0.10.1 and mistralai@2.4.6;
• @transtack/* npm packages and other compromises (exhaustive list at the last two references);
• Any system (developer workstation, CI/CD server, production environment) having executed npm install, pnpm install, yarn install or pip install on one of the versions listed on May 11, 2026 is considered potentially compromised;