Malicious npm worm hits TanStack Router, stealing secrets

According to StepSecurity's OSS Package Security Feed, the Shai-Hulud worm compromised 5 official @tanstack packages across 10 malicious versions, injecting credential-stealing malware into a popular React routing library. On May 11, 2026, at approximately 19:20 UTC, ten malicious versions were published to the npm registry within a six-minute window. The payload is 2.3 MB and obfuscated, designed to harvest GitHub tokens, npm tokens, and CI/CD secrets.

The incident highlights how the Shai-Hulud self-propagating npm worm can ride a legitimate build process and spread via stolen tokens to additional packages. StepSecurity notes that the attack affected the TanStack Router framework, which is used by hundreds of thousands of React projects, and says it will continue to track the compromised packages in real time. The analysis stresses that even with SLSA provenance and a trusted CI/CD pipeline, supply chain threats remain a credible danger.