Skip to content
Mini Shai-Hulud Strikes Again: TanStack + more npm Packages Compromised
wiz.io | blog | #ai-security | #supply-chain | #malware | #github-actions | #npm | #oidc | #teampcp | #tanstack
Summary
TeamPCP hit @tanstack (react-router), @uipath, @mistralai, and guardrails-ai by poisoning a GitHub Actions cache and harvesting OIDC tokens from runner memory to publish without npm credentials.
- Published
- Collected