The npm package @tanstack/eslint-plugin-start versions 0.0.4 and 0.0.7 contain malicious code introduced by the TeamPCP threat actor. This malware steals credentials and propagates itself to other packages within the environment, aiming to maintain persistence on infected systems. The compromise is part of a larger worm campaign named "Mini Shai-Hulud is back." Due to the nature of the infection, any system with this package installed should be treated as fully compromised, requiring secret rotation and thorough remediation beyond simple package removal.

Systems with the affected versions of @tanstack/eslint-plugin-start installed are fully compromised. The malicious code steals credentials and can propagate to other packages, potentially exposing sensitive information and allowing unauthorized control. Persistence mechanisms mean that simply uninstalling the package may not remove all malicious components, increasing the risk of ongoing compromise.

Immediate removal of the affected package versions (0.0.4 and 0.0.7) is recommended. However, because the system is considered fully compromised, all secrets and keys stored on the system must be rotated from a separate, trusted computer. Comprehensive incident response and system remediation should be conducted to ensure removal of all malicious artifacts. No official patch or fix is available; mitigation relies on removal and secret rotation.