IT之家5 月 25 日消息，国家网络安全通报中心今日发布预警，称监测发现，全球主流 JavaScript 软件包管理平台 npm 遭“沙虫”（Shai-Hulud）供应链投毒攻击。攻击者攻陷了 npm 官方维护者账户，并在短时间内批量投放大量恶意软件包，涉及 300 余个独立程序包的 600 余个恶意版本，影响多个热门开源项目。 据介绍，当开发者安装恶意依赖包后，程序会自动在本地主机、CI / ...

The first half of this year has been marked by a series of attacks on supply chains in the npm and PyPi ecosystems—and the culprit is TeamPCP, which stepped up the attacks as the months rolled on. But ...

To continue reading this content, please enable JavaScript in your browser settings and refresh this page. Preview this article 1 min Somasegar spent the past decade ...

On May 11, 2026, a self-replicating worm called Mini Shai-Hulud quietly slipped into 42 widely used TanStack open-source packages, corrupting 84 npm artifacts before anyone noticed. Within hours, the ...

OpenAI has said it found no evidence that user data was accessed following a security issue linked to a supply-chain attack involving the open-source TanStack npm library. The company said in a ...

TanStack had 2FA, OIDC publishing, and Sigstore provenance on every release. The Mini Shai-Hulud worm published 84 malicious versions anyway. The CI/CD Trust-Chain Audit Grid maps the six gaps it ...

NPM生态遭大规模供应链攻击！TanStack、Mistral AI、UiPath等160+软件包被投毒，恶意代码窃取AWS/GCP密钥、GitHub令牌。立即查看受 ...

IT之家5 月 12 日消息，网络安全检测机构 Socket 于当地时间 5 月 11 日发出警报，在开源工具库 TanStack 旗下约 84 个 NPM 软件包的恶意版本中发现疑似凭证窃取恶意代码。 受影响软件包覆盖 42 个 @tanstack/* 命名空间下的项目，其中 @tanstack / react-router 的周下载量超 1200 ...

The post Mini Shai-Hulud Is Back: 172 npm and PyPI Packages Compromised in Latest Wave appeared first on Mend. This is a continuation of the original Shai-Hulud campaign that first targeted SAP CAP ...

Over 170 packages across multiple high-profile NPM and PyPI projects were compromised in a new, coordinated Mini Shai-Hulud software supply chain attack. The campaign hit 42 TanStack packages, 65 ...