Shai-Hulud-Style npm Worm Hits

Multiple npm packages across @tanstack, @mistralai, @uipath, @squawk, and safe-action namespaces were compromised in a worm-like attack affecting over 50 packages. The malicious code executes during installation, downloading the Bun runtime and running a payload that harvests GitHub credentials and cloud secrets. The attack specifically targets AWS environments by querying the IMDS and attempting privilege escalation through STS and SSM endpoints across multiple regions. Stolen credentials are automatically used to publish additional malicious package versions across different maintainer accounts, creating a self-propagating infection chain. The attack patterns mirror previous Shai-Hulud compromises, using a drop-and-execute technique and command-and-control infrastructure at git-tanstack.com, a domain designed to mimic legitimate tanstack.com traffic. Organizations should rotate GitHub credentials, audit AWS credentials, and check for suspicious activity.

• LiteLLM supply chain compromiseCampaign2026-10-22
• TensorLake npm SDK Compromised in ChainDrop Shai-Hulud Credential-Stealing AttackCampaign2026-10-08
• Notorious Brazilian Magecart group hijacks Convertr checkouts via Plausible analyticsCampaign2026-10-27
• Infostealer riding the AI TrainMalware2026-10-23
• ARTEX in the Wild: Storm-0940 Expands Targeting of IT and Software VendorsMalware2026-10-22