Mini Shai-Hulud Worm Hits TanStack npm With Dead-Man's Switch

42 TanStack npm packages got hijacked on May 11, 2026, and the malware they shipped is built to wipe your home directory the second you try to revoke the stolen GitHub token. The attack chain stacked three GitHub Actions weaknesses, and per TanStack's postmortem each was necessary. A fork PR using pull_request_target poisoned the shared dependency cache with a tampered pnpm store. When a legitimate PR got merged the next day, the release workflow pulled that cache, scanned the runner process's memory, and lifted the OIDC token that grants TanStack's trusted-publisher access to npm — publishing straight to the @tanstack scope. Because the publish came from the real workflow with the real token, the malicious packages carry valid SLSA Build Level 3 provenance attestations. Per StepSecurity, this is the first documented npm worm to ship validly-attested malicious packages. Researcher Nicholas Carlini flagged the compromise about twenty minutes after publish. The payload also installs a gh-token-monitor service (systemd on Linux, LaunchAgent on macOS) that polls GitHub's user API every sixty seconds; if it gets a 401, it runs rm -rf on the home directory. Researchers are calling this self-propagating worm family Mini Shai-Hulud, linked to a group calling itself TeamPCP. TanStack's postmortem advises that anyone who installed an affected version on May 11 should treat that host as potentially compromised — rotate credentials before revoking the GitHub token. Sources: TanStack postmortem: https://tanstack.com/blog/npm-supply-chain-compromise-postmortem StepSecurity analysis: https://www.stepsecurity.io/blog/mini-shai-hulud-is-back-a-self-spreading-supply-chain-attack-hits-the-npm-ecosystem Socket coverage: https://socket.dev/blog/tanstack-npm-packages-compromised-mini-shai-hulud-supply-chain-attack Carlini's GitHub issue: https://github.com/TanStack/router/issues/7383 More on cybersecurity, privacy, scams, and homelab on Hake Hardware. New shorts every weekday. #cybersecurity #npm #supplychainattack