An attacker compromised 42 @tanstack/* npm packages by combining GitHub Actions cache poisoning and runtime memory extraction of an OIDC token, publishing 84 malicious versions on 2026-05-11. The attack was detected within 20 minutes by an external researcher and all affected versions have been deprecated, but users who installed the affected versions are recommended to rotate their credentials.