Post

84 TanStack npm package artifacts were compromised in the ongoing Mini Shai-Hulud supply chain attack, adding suspected CI credential-stealing malware. Socket flagged every malicious version within six minutes of publication. Details: socket.dev/blog/tanstac...

socket.devTanstack npm Packages Compromised in Ongoing Mini Shai-Hulud...Socket detected 84 compromised TanStack npm packages modified with suspected CI credential-stealing malware.

11/5/26, 8:35 pm35 reposts67 likes

Zach Leatherman

@zachleat.com

11 May

“the attacker used an orphaned commit to gain access to the workflow run that stores the OIDC token, effectively bypassing the project’s existing publishing protections” well, wait: an external fork had access to the OIDC token? how?

James

@43081j.com

11 May

Probably pr target trigger again 😬 It runs the action in the context of the source repo but using the code from the fork. Tough one to keep secure

Corbin Crutchley

@crutchcorn.dev

11 May

More or less; yes. We'll have more information in a blog post, but for now we're locking things down and fixing the problem. We have a good understanding of how this attack vector was carried about

Zach Leatherman

@zachleat.com

11 May

appreciate it! I’m hoping this setting would have been enough to mitigate otherwise I will officially lose my shit 😅

Michael Warren

@michaelwarren.dev

11 May

good luck with the mitigation plan, folks! sorry this happened

Justin Grote

@posh.guru

13 May

Good thing I pin my tanstack and use dependabot! None of my repos are currently affected.

Socket

@socket.dev

12 May

🚨 Update: Four @opensearch.org Project npm versions are confirmed compromised as part of the ongoing Mini Shai-Hulud campaign: 3.5.3 3.6.2 3.7.0 3.8.0 This project sees 1.3M weekly downloads. We're continuing to track the campaign as it propagates across the npm ecosystem.

socket.devTanStack npm Packages Compromised in Ongoing Mini Shai-Hulud...Socket detected 84 compromised TanStack npm package artifacts modified with suspected CI credential-stealing malware.

naugtur

@naugtur.pl

12 May

Malware published to Tanstack packages graduated to better delivery method bsky.app/profile/naug...

naugtur@naugtur.pl

New and noteworthy: the attackers graduated from postinstall to git repo lifecycle "prepare" script because npm cli runs it even if you set ignore-scripts=true Same day we published: lavamoat.github.io/guides/harde...

lavamoat.github.ioHarden your local development environmentA guide on how to settings that minimise the risk of local dev compromise.

Pier

@pierbover.com

11 May

github.com/TanStack/rou...

github.comSeveral npm latest releases are compromised · Issue #7383 · TanStack/routerWe are actively investigating this security incident and sharing our findings here: www.stepsecurity.io/blog/mini-shai-hulud-is-back-a-self-spreading-supply-chain-attack-hits-the-npm-ecosystem