TanStack Npm Packages Compromised Inside The Mini Shai Hulud Supply Chain Attack

Snyk reported a coordinated supply‑chain campaign branded “Mini Shai‑Hulud” that compromised numerous packages across ecosystems in late Apr–May 2026. The May 11 incident abused GitHub Actions via a "Pwn Request," cache poisoning, and OIDC token extraction from runner memory to inject malicious code into 84 npm artifacts across 42 @tanstack/* (and related) packages — notably producing tampered artifacts with valid SLSA Build Level 3 attestations. This campaign is linked to earlier Bun‑based credential‑stealer releases: a malicious lightning PyPI package that exfiltrates credentials on import,.