TanStack Npm Packages Compromised Inside The Mini Shai Hulud Supply Chain Attack
2026-05-13T08:52:10Z•3d3f6f1fc6e8fba3c52e37ce2ea7bff7705ad2bfdf055edf3375694eaa4002ed
buncache-poisoningcredential-stealergithub-actionsincident-responselightning-pypimini-shai-huludnpmoidc-token-exfiltrationpackage-compromisepwn-requestpypirunner-memorysapslsa-level-3snyk-advisorysupply-chain-attacktanstackthymeleaftoken-theft
What happened
Snyk reports a series of high-impact supply-chain incidents in late Apr–May 2026: the “Mini Shai‑Hulud” campaign deployed Bun‑based credential stealers in malicious npm and PyPI releases (including a compromised lightning PyPI release and earlier SAP package compromises), and on May 11 a worm-style compromise altered 84 npm artifacts across 42 @tanstack/* packages (and other namespaces) by chaining a GitHub Actions “Pwn Request,” cache poisoning, and OIDC token extraction from runner memory — producing the first npm supply‑chain compromise with valid SLSA Build Level 3 attestations. Separately
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- snyk_blog
- Record identifier
- 3d3f6f1fc6e8fba3c52e37ce2ea7bff7705ad2bfdf055edf3375694eaa4002ed
- Enrichment time
- 2026-05-13T08:52:10Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.