Summary
A malicious version of the @tanstack/query-core npm package was published in a supply chain attack that harvested GitHub Actions tokens from CI/CD pipelines using the compromised package, resulting in the exfiltration of 170 private CrowdStrike repositories. TanStack Query is one of the most widely used data fetching libraries in the React ecosystem. The exfiltration of 170 private CrowdStrike repositories represents a significant security intelligence breach given CrowdStrike’s position as a leading cybersecurity vendor.
Timeline
| Date | Event |
|---|---|
| Sep 20, 2026 | Malicious @tanstack/query-core version identified; GitHub Actions token harvesting confirmed; 170 private CrowdStrike repos exfiltrated |
What Happened
The attack introduced a malicious version of @tanstack/query-core to the npm registry containing code that executed during CI/CD pipeline runs to harvest GitHub Actions tokens from the environment. These tokens have access to the repositories and workflows of the organization running the pipeline. CrowdStrike, which uses TanStack Query in its development workflows, had 170 private repositories exfiltrated as a result.
CrowdStrike develops endpoint detection and response software deployed across millions of enterprise endpoints. Private repositories may contain detection logic, threat intelligence, internal tooling, and vulnerability research valuable to threat actors seeking to evade CrowdStrike’s detection capabilities.
Domain Intelligence
tanstack.com — 61.42 — TanStack is the maintainer of the compromised npm package. crowdstrike.com — 61.78 — CrowdStrike is the victim organization whose private repositories were exfiltrated.