Mini Shai-Hulud Hits TanStack npm Packages

Reported 21 May 2026 by otx · Severity: medium

The Mini Shai-Hulud campaign compromised 84 npm package artifacts in the TanStack namespace with credential-stealing malware targeting continuous integration systems. On May 11, 2026, attackers published 84 malicious versions across 42 TanStack packages by chaining the pull_reque