PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Mini Shai-Hulud Strikes Again: TanStack + more npm Packages Compromised

wiz.io | blog | #ai-security | #supply-chain | #malware | #github-actions | #npm | #oidc | #teampcp | #tanstack
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

TeamPCP hit @tanstack (react-router), @uipath, @mistralai, and guardrails-ai by poisoning a GitHub Actions cache and harvesting OIDC tokens from runner memory to publish without npm credentials.
Published
Collected

Related coverage

blog · wiz.io
The Worm That Keeps on Digging: TeamPCP Hits @antv in Latest Wave
Wiz attributes the cross-ecosystem campaign to TeamPCP: @antv npm packages, actions-cool/issues-helper GitHub Action, and a VS Code extension steal credentials and drop a GitHub-polled backdoor.
incident · aikido.dev
Popular code generator for TanStack Query hit by supply chain worm
This incident coverage highlights active npm package poisoning and practical supply chain defensive lessons.
blog · wiz.io
Supply Chain Campaign Targets SAP npm Packages with Credential-Stealing Malware
TeamPCP's 'Mini Shai Hulud' campaign trojanized SAP-related npm packages with preinstall scripts, later hitting intercom-client and lightning, harvesting Kubernetes, Vault, and cloud credentials.
blog · wiz.io
Six Accounts, One Actor: Inside the prt-scan Supply Chain Campaign
Wiz Research traced six waves of pull_request_target exploitation to one actor three weeks before disclosure: 500+ PRs, two npm packages hit, payloads evolving from bash to AI-generated.
blog · wiz.io
A security community success story of mitigating a misconfiguration
The story of fixing a common misconfiguration: GitHub Actions OIDC trust policies missing their 'sub' condition let anyone assume AWS roles, until coordinated research pushed defaults to change.
blog · aikido.dev
Good riddance, TeamPCP. Now for the hard part.
This incident analysis explains systemic gaps in package registry security exposed by recent malicious campaigns.
Back