TanStack had 2FA, OIDC publishing, and Sigstore provenance on every release. The Mini Shai-Hulud worm published 84 malicious ...
Morning Overview on MSN
The 'mini Shai-Hulud' attack hides inside AI coding agent configs — the first supply chain attack to weaponize Claude Code and VS Code as persistence vectors
On April 29, 2026, someone slipped malicious code into four widely used SAP software packages. Within days, the infection had ...
An attacker has published 84 malicious versions of official TanStack npm packages, with the impact including credential theft ...
The wave of supply chain attacks aimed at security and developer tools has washed up more victims, namely SAP and Intercom ...
An attacker poisoned 84 TanStack npm versions across 42 packages, stealing GitHub OIDC tokens and cloud keys while planting a ...
Researchers say the campaign targeted developer credentials and cloud secrets while abusing trusted publishing and AI coding tool configurations.
New npm malware has been caught stealing credentials from the Google Chrome web browser by using legitimate password recovery tools on Windows systems. Additionally, this malware listens for incoming ...
Some results have been hidden because they may be inaccessible to you
Show inaccessible results