TeamPCP Used Mini Shai-Hulud Worm to Poison Over 400 npm and PyPI Packages (opens in new tab)

Covers 4 stories including Mini Shai-Hulud - TanStack and more npm packages compromised, with SLSA Build Level 3 provenance attestations

Research reveals that TeamPCP hijacked OIDC tokens to poison hundreds of TanStack, Mistral AI, and UiPath packages with the self-propagating Mini Shai-Hulud worm.

Read the original article