Back to article

stepsecurity.io

Mini Shai-Hulud - TanStack and more npm packages compromised, with SLSA Build Level 3 provenance attestations (opens in new tab)

Covers Postmortem: TanStack NPM supply-chain compromiseCovered by 11 sources including This Week In 4n6, infoworld.comDiscussed on Lobsters

Covers 1 related story

TanStack Blog·

Postmortem: TanStack NPM supply-chain compromise

Discussed on Hacker News, Hacker News, Lobsters, r/netsec, r/programming, and DEV

Covered in 12 articles

This Week In 4n6·

Week 20

infoworld.com·

AI’s brave new world of technical debt

TeamPCP Used Mini Shai-Hulud Worm to Poison Over 400 npm and PyPI Packages

venturebeat.com·

Four AI supply-chain attacks in 50 days exposed the release pipeline red teams aren't covering

Help Net Security·

TeamPCP breached GitHub’s internal codebase via poisoned VS Code extension

Security Affairs·

INTERNATIONAL EDITION

Security Affairs·

OpenAI hit by supply chain attack linked to malicious TanStack packages

blog.outsider.ne.kr·

기술 뉴스 #294 : 26-05-16

Mini Shai-Hulud: Frequently asked questions about the TeamPCP npm and PyPI supply chain campaign

podrocket.logrocket.com·

Bun's rust rewrite, the TanStack hack, and the $60B Cursor deal

In other languages

CERT-SE:s veckobrev v.20