Mini Shai-Hulud Supply Chain Attack: @tanstack/react-router npm Packages Compromised
TeamPCP's Mini Shai-Hulud campaign published 84 malicious versions across 42 @tanstack npm packages on May 11 2026, including @tanstack/react-router. The self-propagating worm stole credentials via OIDC memory extraction, poisoned GitHub Actions caches, and carried valid SLSA Build Level 3 provenance. Here is the full technical breakdown.