TanStack npm Packages Compromised in Ongoing Mini Shai-Hulud Supply-Chain Attack

Canister -@Canister

•updated May 13, 2026•50•0•719

A large-scale supply-chain attack where 84 compromised npm package artifacts in the tanstack namespace were modified with credential-stealing malware. The incident is tracked as part of the ongoing Mini Shai-Hulud campaign. ref: https://socket.dev/blog/tanstack-npm-packages-compromised-mini-shai-hulud-supply-chain-attack