TanStack Npm Packages Compromised Inside The Mini Shai Hulud Supply Chain Attack
The Mini Shai-Hulud campaign chained GitHub Actions abuse, cache poisoning, and OIDC token theft to compromise 84 npm artefacts—setting a new benchmark for CI/CD supply-chain attack sophistication.
Summary written by editorial AI · Source link below
On May 11, 2026, the Mini Shai-Hulud worm compromised 84 npm package artifacts across 42 @tanstack/* packages (as well as @squawk/*, @mistralai/* packages, and others) by chaining a GitHub Actions "Pwn Request," cache poisoning, and OIDC token extraction from runner memory — producing the first npm supply chain attack with valid SLSA Build Level 3 attestations. Here's what happened, what was stolen, and what you need to do right now.
Editorial Analysis
This multi-vector attack proves that CI/CD pipelines are now a primary attack surface; enterprises must treat build infrastructure with the same rigour as production environments.
Audit all GitHub Actions workflows for pull_request_target usage and OIDC token scoping, and enforce immutable build caches.
A sophisticated supply-chain attack compromised 84 widely-used JavaScript packages by exploiting CI/CD pipeline weaknesses, exposing downstream enterprise applications to code injection risk.
Forward-looking interpretation drafted by editorial AI under human review — not a reproduction of the source. See methodology.
External link — opens at Snyk Blog in a new tab.
More from the DevSecOps Desk
- Nearly 1.5 million exposed secrets targeted in new revocation program4d
- From Lab to Reality: A Practical Evaluation of Deep Learning Models and LLMs for Vulnerability Detection4d
- A.S.E 2.0: Understanding How Repository Context Impacts the Security of LLM-Generated Code4d
- A Hybrid Approach for Automated Security Pattern Recovery4d
- Chainguard endpoints now handle breaking changes5d