# TanStack Npm Packages Compromised Inside The Mini Shai Hulud Supply Chain Attack

DevFeed: [TanStack Npm Packages Compromised Inside The Mini Shai Hulud Supply Chain Attack](<https://devfeed.tech/articles/tanstack-npm-packages-compromised-inside-the-mini-shai-hulud-supply-chain-attack-8204.md>)

Original publisher: [Read original article](<https://snyk.io/blog/tanstack-npm-packages-compromised/>)

Author: Stephen Thoemmes

Published: 2026-05-11T05:00:00Z

Content type: news

Language: en

Sources: [Blog RSS Feed | Snyk](<https://devfeed.tech/sources/blog-rss-feed-snyk.md>)

Topics: [incident](<https://devfeed.tech/topics/incident.md>)

Tags: [article](<https://devfeed.tech/tags/article.md>), [attacks](<https://devfeed.tech/tags/attacks.md>), [cache](<https://devfeed.tech/tags/cache.md>), [ci-cd](<https://devfeed.tech/tags/ci-cd.md>), [cryptographic](<https://devfeed.tech/tags/cryptographic.md>), [developer](<https://devfeed.tech/tags/developer.md>), [devops](<https://devfeed.tech/tags/devops.md>), [devsecops](<https://devfeed.tech/tags/devsecops.md>), [github](<https://devfeed.tech/tags/github.md>), [github-actions](<https://devfeed.tech/tags/github-actions.md>), [identity](<https://devfeed.tech/tags/identity.md>), [incident](<https://devfeed.tech/tags/incident.md>), [maintainers](<https://devfeed.tech/tags/maintainers.md>), [memory](<https://devfeed.tech/tags/memory.md>), [npm-packages](<https://devfeed.tech/tags/npm-packages.md>), [open-source-security](<https://devfeed.tech/tags/open-source-security.md>), [sbom](<https://devfeed.tech/tags/sbom.md>), [scm](<https://devfeed.tech/tags/scm.md>), [security](<https://devfeed.tech/tags/security.md>), [snyk-open-source](<https://devfeed.tech/tags/snyk-open-source.md>), [snyk-security-intel](<https://devfeed.tech/tags/snyk-security-intel.md>), [supply-chain](<https://devfeed.tech/tags/supply-chain.md>), [supply-chain-security](<https://devfeed.tech/tags/supply-chain-security.md>), [teampcp](<https://devfeed.tech/tags/teampcp.md>), [tech](<https://devfeed.tech/tags/tech.md>), [toolchain](<https://devfeed.tech/tags/toolchain.md>), [vulnerability-insights](<https://devfeed.tech/tags/vulnerability-insights.md>), [workflow](<https://devfeed.tech/tags/workflow.md>)

## AI overview

TanStack's legitimate release pipeline was hijacked to publish malicious npm packages with valid SLSA provenance. The article describes the Mini Shai-Hulud supply-chain attack, its impact, and remediation guidance to rotate secrets on affected install environments.

## Source excerpt

On May 11, 2026, the Mini Shai-Hulud worm compromised 84 npm package artifacts across 42 @tanstack/* packages (as well as @squawk/*, @mistralai/* packages, and others) by chaining a GitHub Actions "Pwn Request," cache poisoning, and OIDC token extraction from runner memory -- producing the first npm supply chain attack with valid SLSA Build Level 3 attestations. Here's what happened, what was stolen, and what you need to do right now.