A Day in the Life of a Strategy Co-Op in Snyk’s Boston Office

Between May 11–20, 2026 an active supply‑chain campaign dubbed “Mini Shai‑Hulud” and related activity rapidly expanded across ecosystems. Initial compromises (TanStack on May 11) used a GitHub Actions “Pwn Request”, cache‑poisoning and OIDC token extraction from runner memory to push malicious npm artifacts with valid SLSA attestation. Subsequent waves included node‑ipc (malicious npm versions published), a surge of 300+ malicious AntV npm package versions via a compromised maintainer account, and lateral movement to PyPI by compromising Microsoft‑associated durabletask. Snyk is tracking the事件