Open Source
TanStack Npm Packages Compromised Inside The Mini Shai Hulud Supply Chain Attack
Snyk Blog0 views
On May 11, 2026, the Mini Shai-Hulud worm compromised 84 npm package artifacts across 42 @tanstack/* packages (as well as @squawk/*, @mistralai/* packages, and others) by chaining a GitHub Actions "Pwn Request," cache poisoning, and OIDC token extraction from runner memory — producing the first npm supply chain attack with valid SLSA Build Level 3 attestations. Here's what happened, what was stolen, and what you need to do right now.
Source：https://snyk.io/blog/tanstack-npm-packages-compromised/PreviousMalicious node-ipc versions published to npm in suspected maintainer account compromiseNextlightning PyPI Compromise: A Bun-Based Credential Stealer in Python
Related posts
My uninstaller refuses to delete anything it can't prove belongs to the app. Poke holes in my safety rules
0dev.to C#
让 AI 编程助手少返工：10 条命令规则合集（免费读）
0dev.to OpenSource
Discovering contemporaneous and lagged causal relations in autocorrelated nonlinear time series datasets
0arXiv stat.ML
I3L: Iterative Interactive Imitation Learning for Whole-Body Mobile Manipulation
0arXiv cs.RO
Sequential Planning via Anchored Robotic Keypoints
0arXiv cs.RO
WildOS: Open-Vocabulary Object Search in the Wild
0arXiv cs.RO