corpus.blog
41554 blogs · 4,417,066 posts Claim your blog
Record · corpus.blog/posts/01a07df5-49ee-7218-91aa-008e322b7d52

TanStack Npm Packages Compromised Inside The Mini Shai Hulud Supply Chain Attack

Snyk · published 11 May 2026

A record is what was published and who pointed at it. The text of the post is not held here: read it at the source, or at its Wayback capture.

Read the post at snyk.io Wayback capture
9blogs citing
First cited
13 May 2026
Most recent
23 Sept 2026
Rank this month
not ranked
Links from this post
38
Words captured
3,270

Cited by

Blog
In the post
Date
ashu.co
Scaling agents locally with Incus, Ansible, Tailscale Read at the source ↗
23 Sept 2026
zeitraum.blog
wet: write every time Read at the source ↗
9 Aug 2026
zeitraum.blog
wet: write every time Read at the source ↗
9 Aug 2026
abacusnoir.com
Permanence Was an Accident Read at the source ↗
21 Jul 2026
schaerli.org
Proton's crypto is not Transparent and not OPAQUE Read at the source ↗
23 Jun 2026
OpenSSF Blog
Mini Shai-Hulud: Where SLSA’s Boundaries Fall Read at the source ↗
10 Jun 2026
radval.me
npm install and pray. Axios and TanStack, 2026. Read at the source ↗
22 May 2026
vulncheck.com
Quantifying 2026 Routinely Targeted Vulnerabilities (So Far) Read at the source ↗
21 May 2026
janbrennenstuhl.eu
Dependency Updates: latest Is Not a Security Strategy Read at the source ↗
15 May 2026
Sourcegraph
How we're using Sourcegraph and a Slack bot to detect vulnerabilities and react quickly Read at the source ↗
13 May 2026

Links from this post

Link
Host
https://security.snyk.io/package/npm/%40tanstack%2Freact-router
security.snyk.io
https://api.npmjs.org/downloads/point/last-week/%40tanstack%2Freact-router
api.npmjs.org
https://www.stepsecurity.io/blog/mini-shai-hulud-is-back-a-self-spreading-supply-chain-attack-hits-the-npm-ecosystem
stepsecurity.io
https://github.com/TanStack/router/security/advisories/GHSA-g7cv-rxg3-hmpx
github.com
https://www.wiz.io/blog/trivy-compromised-teampcp-supply-chain-attack
wiz.io
https://www.stepsecurity.io/blog/ctrl-tinycolor-and-40-npm-packages-compromised
stepsecurity.io
https://www.stepsecurity.io/blog/sha1-hulud-the-second-coming-zapier-ens-domains-and-other-prominent-npm-packages-compromised
stepsecurity.io
https://trigger.dev/blog/shai-hulud-postmortem
trigger.dev
https://www.stepsecurity.io/blog/a-mini-shai-hulud-has-appeared
stepsecurity.io
https://www.wiz.io/blog/mini-shai-hulud-supply-chain-sap-npm
wiz.io
Weaponizing the Protectors: TeamPCP’s Multi-Stage Supply Chain Attack on Security Infrastructure Read at the source ↗
unit42.paloaltonetworks.com
https://www.cisa.gov/news-events/alerts/2025/09/23/widespread-supply-chain-compromise-impacting-npm-ecosystem
cisa.gov
https://www.cisa.gov/news-events/alerts/2025/03/18/supply-chain-compromise-third-party-tj-actionschanged-files-cve-2025-30066-and-reviewdogaction
cisa.gov
https://security.snyk.io/TanStack-npm-Supply-Chain-Compromise-May-2026
security.snyk.io
https://security.snyk.io/package/npm/%40mistralai%2Fmistralai
security.snyk.io
https://github.com/mistralai/client-ts/issues/217
github.com
https://raw.githubusercontent.com/ossf/malicious-packages/main/osv/malicious/npm/@mistralai/mistralai/MAL-2026-3432.json
raw.githubusercontent.com
Postmortem: TanStack npm supply-chain compromise Read at the source ↗
tanstack.com
The Monsters in Your Build Cache - GitHub Actions Cache Poisoning Read at the source ↗
adnanthekhan.com
https://github.com/TanStack/router/actions/runs/25613093674
github.com
https://github.com/TanStack/router/actions/runs/25691781302
github.com
https://www.upwind.io/feed/mini-shai-hulud-npm-supply-chain-worm
upwind.io
The npm Threat Landscape: Attack Surface and Mitigations (Updated July 15) Read at the source ↗
unit42.paloaltonetworks.com
https://github.com/TanStack/router/issues/7383
github.com
https://news.ycombinator.com/item?id=48100706
news.ycombinator.com
https://socket.dev/blog/tanstack-npm-packages-compromised-mini-shai-hulud-supply-chain-attack
socket.dev
3 pnpm Settings to Protect Yourself from Supply Chain Attacks Read at the source ↗
gajus.com
https://github.blog/changelog/2026-02-18-npm-bulk-trusted-publishing-config-and-script-security-now-generally-available/
github.blog
https://snyk.io/articles/poisoned-security-scanner-backdooring-litellm/
snyk.io
https://app.snyk.io/login
app.snyk.io
https://github.com/GLPMC/Tanstack-Worm-Detector
github.com
https://github.com/omarpr/mini-shai-hulud-ioc-scanner
github.com
https://app.snyk.io/auth/auth0/waad
app.snyk.io
https://app.snyk.io/auth/docker
app.snyk.io
https://app.snyk.io/auth/auth0/bitbucket
app.snyk.io
https://snyk.io/policies/terms-of-service/
snyk.io
https://snyk.io/policies/privacy/
snyk.io
https://github.com/zblgg/configuration
github.com