Mini Shai-Hulud’s May 11 npm Wave Added Developer-Tool Persistence

On May 11, 2026, attackers published 84 malicious versions across 42 TanStack npm packages. TanStack’s postmortem says the chain combined an untrusted pull request, GitHub Actions cache poisoning, and extraction of an OIDC token from runner memory. The maintainers say no npm publishing token was stolen in this event.

StepSecurity’s analysis of the same Mini Shai-Hulud wave describes the package payload’s behavior after installation. It harvested developer and CI secrets, attempted to spread to other packages, and wrote persistence into developer-tool configuration. A Claude Code SessionStart hook ran the malware when a session began; a VS Code folder-open task ran it when a project was opened. The payload also installed an operating-system service. Those hooks could remain after removal of the compromised dependency.

The affected versions were detected by an external researcher shortly after publication. TanStack deprecated them and worked with npm to remove their tarballs. The maintainers clarified scope: 42 Router/Start monorepo packages were affected, while other TanStack product families remained unaffected.

If a compromised version was installed:

• Check lockfiles and package trees for affected versions before rotating accessible credentials
• Compare Claude Code settings and VS Code tasks against trusted versions; dependency removal alone does not remove injected configuration
• Separate untrusted build and test caches from release workflows that can mint publishing tokens

A distinct Mini Shai-Hulud wave hit the AntV package ecosystem on May 19 and used similar developer-tool persistence mechanisms.