Tag

self-propagating-worm

Safeguard articles tagged "self-propagating-worm" — guides, analysis, and best practices for software supply chain and application security.

1 article

Supply Chain Attacks

TanStack and the Mini Shai-Hulud npm Worm (May 2026): Anatomy of a CI-Native Supply Chain Attack

On 11-12 May 2026, the TeamPCP-linked Mini Shai-Hulud worm published 84 malicious artifacts across 42 TanStack npm packages in six minutes, then spread to 160+ packages by abusing GitHub Actions OIDC tokens and CI cache poisoning.

May 13, 202612 min read