TanStack Npm Packages Compromised Inside The Mini Shai Hulud Supply Chain Attack

2026-05-11来源 Snyk BlogEnglish
TanStack Npm Packages Compromised Inside The Mini Shai Hulud Supply Chain Attack
On May 11, 2026, the Mini Shai-Hulud worm compromised 84 npm package artifacts across 42 @tanstack/* packages (as well as @squawk/*, @mistralai/* packages, and others) by chaining a GitHub Actions "Pwn Request," cache poisoning, and OIDC token extraction from runner memory — producing the first npm supply chain attack with valid SLSA Build Level 3 attestations. Here's what happened, what was stolen, and what you need to do right now.

原文：https://www.a8q9.cn/en/article/tanstack-npm-packages-compromised-inside-the-mini-shai-hulud-supply-chain-attack-774aa8.html

相关文章