WizPublished
Mini Shai-Hulud Strikes Again: TanStack more npm Packages Compromised
By Rami McCarthy, Amitai Cohen, Benjamin Read
Excerpt
On 11 May 2026, TeamPCP launched a coordinated supply chain attack against the npm and PyPi ecosystems, compromising packages across multiple namespaces simultaneously.
May 13, 2026 2:30 UTC update: Further analysis of the @uipath/* and @mistralai/* npm packages has identified a bug in the payload that renders the malware non-functional in those cases.
Impacted packages include:
Packages in the @tanstack namespace, which includes @tanstack/react-router , one of the most widely-used routing libraries in the…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by Wiz on wiz.io.
Mentioned in the excerpt
More from Wiz3
- KICS GitHub Action Compromised: TeamPCP Strikes Again in Supply Chain AttackWiz · Published 23 Mar
- Trivy Compromised: Everything You Need to Know about the Latest Supply Chain AttackWiz · Published 20 Mar
On the same topics
- From PostCSS Masquerading to Windows RATJFrog · Published 22 Jun
- Trust the Tunnel, Get the Trojan: Silver Fox Delivers Atlas RAT via Weaponized VPN Installershexastrike.com · Published 25 Mar
- Fake Web3 Accelerator Uses npm Packages to Spread Malware and Hijack AI Agent TrafficThe Hacker News · Published 19 Oct
- Investigating Ephemeral Supply Chain TamperingMandiant (Google) · Published 15 Oct
