---
id: 6837
title: "Mini Shai-Hulud Strikes Again: TanStack + more npm Packages Compromised"
source_domain: wiz.io
source_url: "https://www.wiz.io/blog/mini-shai-hulud-strikes-again-tanstack-more-npm-packages-compromised"
published_at: "2026-05-12T01:38:56Z"
tags: ["ai-security", "supply-chain", "malware", "github-actions", "npm", "oidc", "teampcp", "tanstack"]
phying_url: "https://phying.com/item/6837"
lang: en
---

# Mini Shai-Hulud Strikes Again: TanStack + more npm Packages Compromised

## Summary

TeamPCP hit @tanstack (react-router), @uipath, @mistralai, and guardrails-ai by poisoning a GitHub Actions cache and harvesting OIDC tokens from runner memory to publish without npm credentials.

## Intelligence Metadata

- **Sources:** wiz.io
- **Published:** 2026-05-12T01:38:56Z
- **Original:** https://www.wiz.io/blog/mini-shai-hulud-strikes-again-tanstack-more-npm-packages-compromised
- **Phying News:** https://phying.com/item/6837