Mini Shai-Hulud - TanStack and more npm packages compromised, with SLSA Build Level 3 provenance attestations (opens in new tab)

The Mini Shai-Hulud worm is actively compromising legitimate npm packages by hijacking CI/CD pipelines and stealing developer secrets. StepSecurity's OSS Package Security Feed first detected the attack in official @tanstack packages and is tracking its spread across the ecosystem in real time.