84 TanStack npm Packages Hacked in Ongoing Supply-Chain Attack Targeting CI Credentials

High-severity supply-chain compromise: 84 TanStack npm package versions were published with an obfuscated credential‑stealing payload (~2.3 MB router_init.js) that targets CI environments (GitHub Actions) and can exfiltrate AWS/GCP/Kubernetes/HashiCorp Vault credentials, GitHub tokens, SSH keys, and .npmrc contents. The attacker used a malicious optionalDependency pointing to a standalone commit that executes via a prepare lifecycle hook and gained publisher rights via chained GitHub Actions abuses (pull_request_target “Pwn Request”, cache poisoning, and OIDC memory extraction); TanStack deprecated affected versions and recommends rotating credentials, auditing logs, purging caches, and reinstalling from clean lockfiles.