[{"_1":2,"_207":-5,"_208":-5},"loaderData",{"_3":4,"_54":55},"root",{"_5":-5,"_6":-5,"_7":8,"_9":8,"_10":11,"_16":17,"_25":26,"_38":39,"_50":51,"_52":8,"_53":37},"userId","user","isAdmin",false,"resetAdminAnalyticsOverride","cacheKeys",{"_12":13,"_14":15},"notion",[],"files",[],"__cacheKeys",{"_12":18,"_14":19},[],[20],{"_21":22,"_23":24},"label","OG Image","key","og-image:homepage:v4","analyticsConfig",{"_27":28,"_29":30,"_31":32,"_33":34,"_35":8,"_36":37},"provider","ga4","trackingId","G-QSDPMPZJJP","domain","","environment","production","debug","enabled",true,"analyticsScripts",[40,46],{"_41":42,"_43":44,"_45":37},"type","external","src","https://www.googletagmanager.com/gtag/js?id=G-QSDPMPZJJP","async",{"_41":47,"_48":49},"inline","content","window.dataLayer = window.dataLayer || [];\nfunction gtag(){dataLayer.push(arguments);}\n// GA4 initialization with Consent Mode v2\ngtag('consent', 'default', {\n ad_user_data: 'denied',\n ad_personalization: 'denied',\n ad_storage: 'denied',\n analytics_storage: 'granted',\n wait_for_update: 500\n});\n// Initialize GA4\ngtag('js', new Date());\ngtag('config', 'G-QSDPMPZJJP', {\n send_page_view: false,\n // Ensure events can be sent even with consent updates\n allow_google_signals: false,\n allow_ad_features: false\n});","clientLogLevel","warn","newsletterEnabled","contactFormProtectionEnabled","routes/toolkit/items.$slug",{"_56":57,"_95":96,"_97":-7,"_91":92,"_74":75,"_98":37,"_99":8,"_7":8,"_100":101,"_102":103,"_104":105,"_188":37,"_189":8,"_190":191,"_192":193,"_16":195},"item",{"_58":59,"_60":61,"_41":62,"_63":64,"_73":32,"_74":75,"_76":8,"_77":32,"_78":79,"_80":8,"_81":82,"_83":84,"_85":32,"_86":87,"_88":-7,"_89":-7,"_90":-7,"_91":92,"_93":94},"id","35fa80b7-1924-8098-a9c4-c1b22e81f965","title","Mini Shai-Halud","scroll","tags",[65,66,67,68,69,70,71,72],"ai","development","governance","dependency","guide","design","project","machineLearning","path","status","Published","hasValidUrl","publishedLinkUrl","slug","mini-shai-halud","featured","sortDate","2026-05-13T16:22:00.000Z","description",[],"embeddedContent","format","Scroll","epubUrl","pdfUrl","heroMedia","visibility","public","discoverability","discoverable","blocks",[],"firstContentImageUrl","canViewContent","authed","authors",[],"tableOfContents",[],"relatedItems",[106,128,137,144,153,164,173,180],{"_58":107,"_60":108,"_78":109,"_86":87,"_110":32,"_111":112,"_63":113,"_74":75,"_91":127},"33ba80b7-1924-80b0-9b8a-f7d08f4bc757","Getting Started With Jira - Foundations","getting-started-with-jira-foundations","publishedLink","commonTags",[65,67,69,71],[114,115,116,117,118,119,120,121,122,123,124,125,126],"Ai","Governance","Guide","Project","Communication","Collaboration","Agile","Tooling","Jira","Atlassian","Pmo","Health","Projectmanagement","public-with-auth",{"_58":129,"_60":130,"_78":131,"_86":87,"_110":32,"_111":132,"_63":133,"_74":75,"_91":92},"33aa80b7-1924-80bf-85de-cdcd37eff145","Claude and PowerBI","claude-powerbi-scroll",[65,66,69],[114,134,116,135,136],"Development","Career","Prompts",{"_58":138,"_60":139,"_78":140,"_86":87,"_110":32,"_111":141,"_63":142,"_74":75,"_91":92},"33ba80b7-1924-8039-bf8e-fa80c6b09835","Copilot and Microsoft 365, Workflows & Governance","copilot-ms365-workflows-scroll",[65,67,69],[114,115,116,118,119,120,136,143],"Compliance",{"_58":145,"_60":146,"_78":147,"_86":87,"_110":32,"_111":148,"_63":149,"_74":75,"_91":92},"337a80b7-1924-80f9-b1e1-c909d9217a74","CSS Scroll-Margin-Top vs Scroll-Padding-Top","scroll-margin-top-vs-scroll-padding-top",[66,69,70],[134,116,150,151,152],"Design","Ui","Ux",{"_58":154,"_60":155,"_78":156,"_86":87,"_110":32,"_111":157,"_63":158,"_74":75,"_91":92},"32ca80b7-1924-8066-81d1-c3dadb10c061","Developer Experience in an Age of AI","dx-and-ai-scroll",[65,66,69],[114,134,116,159,120,160,161,162,163],"DevOps","Kaizen","Continuousimprovement","Leadership","Alignment",{"_58":165,"_60":166,"_78":167,"_86":168,"_110":169,"_111":170,"_63":171,"_74":75,"_91":92},"33ea80b7-1924-80d7-a968-c590230cf56c","HTML-in-Canvas.dev","html-in-canvas-dot-dev","App","https://html-in-canvas.dev",[66,69,70],[134,116,150,151,152,172,121],"Product",{"_58":174,"_60":175,"_78":176,"_86":87,"_110":32,"_111":177,"_63":178,"_74":75,"_91":92},"32ca80b7-1924-80f9-b78e-dbfe2f68b849","Modal vs Modeless, an exploration","modal-vs-modeless-exploration-scroll",[66,69,70],[134,116,150,179,118,151,152,172],"Focus",{"_58":181,"_60":182,"_78":183,"_86":184,"_110":32,"_111":185,"_63":186,"_74":75,"_91":127},"349a80b7-1924-805d-93ae-dda9e63205f3","PMI Northern Nevada PDD Special Edition - Getting Started With AI Governance","pmi-nnv-pdd-getting-started-with-ai-governance","Handout",[65,67,71],[114,115,117,187,126],"Portfolio","fieldGuideDescriptionEnabled","fieldGuideContentHidden","scrollHtmlContent","\n\n\nMini Shai-Hulud — A Field Guide for Defenders\n\n\n

\n \n\n \n

\n \n

\n\n

\n\n \n

170+

\n Active campaign\n \n Field Guide · v1.0\n \n For npm and PyPI defenders\n

When the worm wears a trusted signature.

On May 11, 2026, a self-propagating worm dubbed Mini Shai-Hulud compromised 84 npm artifacts across 42 @tanstack/* packages in six minutes. Within forty-eight hours the campaign had reached 172 packages across npm and PyPI, totalling more than half a billion cumulative downloads. Every malicious version carried a valid SLSA Build Level 3 provenance attestation. The signatures were genuine. The code was not. This is how it worked, how to know if you were caught, and what to do next.

\n\n

172

Packages hit

403

Malicious versions

518M

Weekly download reach

6 min

From publish to detection

\n\n \n

What it is

An identity attack dressed as a trusted release.

Mini Shai-Hulud is not a typosquat and it is not a hijacked maintainer account. It is a worm that hijacks the release pipeline itself, mints a short-lived publish token through the project's own OIDC binding, and ships a malicious version that the registry, the signer, and every downstream verifier all consider perfectly legitimate.

\n\n

The class of attack

A software supply-chain worm: malware that uses the credentials it steals to infect more packages, which infect more developers, which yield more credentials. The propagation is automatic. No human attacker is in the loop after the initial foothold.

The \"Mini\" in the name refers to a TeamPCP variant first observed in April 2026 against SAP CAP packages. The May wave is its fifth and largest run since the original Shai-Hulud worm appeared in September 2025.

Why it matters

The compromised packages include @tanstack/react-router, which receives approximately 12 million weekly downloads. Other named victims include @uipath/*, @mistralai/*, @opensearch-project/*, and the Guardrails AI PyPI package.

CVE-2026-45321 was issued at CVSS 9.6. The TanStack family is the documented index case, but the worm spreads to anyone whose CI/CD secrets it can reach.

\n\n

The three-link chain

\n \n\n

01 · Pwn Request

A fork opens a draft PR

The TanStack bundle-size workflow ran on pull_request_target for fork PRs and checked out the fork's merge ref. Attacker code ran with the base repo's trust.

02 · Cache Wedge

Poison crosses the boundary

Attacker code wrote a malicious pnpm store into the GitHub Actions cache. When maintainer PRs were merged to main, the release workflow restored the poisoned cache.

03 · Memory Read

OIDC token leaves the runner

Attacker binaries read the runner's /proc/<pid>/mem and extracted the OIDC token. The token was used to mint a short-lived npm publish credential through trusted publishing.

04 · Signed Ship

Sigstore attests honestly

The build pipeline really did run inside tanstack/router on refs/heads/main. The attestation is correct. SLSA proves provenance, not authorisation.

\n\n

\n The attacker did not invent novel tradecraft. They recombined published research.\n — TanStack postmortem, May 12 2026\n

\n\n

Threat actor

TeamPCP

Also tracked as DeadCatx3, PCPcat, ShellForce, CipherForce. Attributed by StepSecurity and Wiz with high confidence based on toolchain reuse from the SAP CAP, Bitwarden CLI, Lightning, Intercom and Trivy compromises.

Payload

2.3 MB obfuscated stealer

A file named router_init.js with daemonisation, ten parallel credential-collection classes, and eleven AES-256-GCM encrypted sub-payloads decrypted only by the Bun runtime.

Exfiltration

Three redundant channels

The Session decentralised messenger network, GitHub dead-drop repositories, and a typosquat domain git-tanstack[.]com. There is no attacker-controlled C2 to block by IP.

\n\n \n

How it spreads

One compromised maintainer becomes a hundred.

A worm earns the name when it spreads without a human in the loop. Once Mini Shai-Hulud lands on a developer machine or a CI/CD runner, it looks at what the victim has the keys to and uses those keys to infect the next set of packages.

\n\n

The propagation loop

\n \n

\n\n

What the worm steals

GitHub Actions OIDC tokens, GitLab and CircleCI runner tokens, AWS IMDSv2 role credentials (169.254.169.254), ECS/Fargate task metadata (169.254.170.2), GCP and Azure metadata, Kubernetes service accounts, HashiCorp Vault tokens on 127.0.0.1:8200, npm and package-registry tokens, cryptocurrency wallets, password managers including 1Password and Bitwarden vault data, and credentials for messaging and AI tooling.

Where it hides

Persistence is dropped into ~/.claude/settings.json as a SessionStart hook, ~/.vscode/tasks.json as a folderOpen task, and ~/.claude/router_runtime.js as the staged payload. On macOS a LaunchAgent named com.user.gh-token-monitor polls GitHub every sixty seconds. On Linux the equivalent runs under systemd.

\n\n

The dead-man switch

The gh-token-monitor daemon polls GitHub with the stolen token. If it receives an HTTP 40x indicating the token was revoked, it attempts to execute rm -rf ~/ on the host. The switch has a 24-hour TTL and exits cleanly afterwards, but if you act within that window you must disable persistence before rotating any tokens.

\n\n \n

Are you compromised?

The first hour matters more than the next ten.

If you installed any affected package between 2026-05-11 19:20 UTC and the deprecation window two to three hours later, treat the install host as compromised. The order of operations below is the consensus guidance from TanStack, StepSecurity, Snyk, Wiz, and Endor Labs.

\n\n

Before you do anything else

Do not revoke npm or GitHub tokens before you have either disabled the dead-man switch or isolated and imaged the affected machine. The destructive handler is the first thing to neutralise.

\n\n

Step 1 — Look for the payload on disk

\n\n

# The 2.3 MB payload is the fastest single check.\n$ find . -name 'router_init.js' -size +1M 2>/dev/null

\n\n

# The orphan-commit SHA from optionalDependencies is a clean signal.\n$ grep -r '79ac49eedf774dd4b0cfa308722bc463cfe5885c' \\\n package-lock.json pnpm-lock.yaml yarn.lock 2>/dev/null

\n\n

# Persistence artefacts in user tooling directories.\n$ ls -la ~/.claude/settings.json \\\n ~/.claude/router_runtime.js \\\n ~/.vscode/tasks.json 2>/dev/null

\n\n

# Disable the dead-man switch before anything else.\n$ launchctl list | grep gh-token-monitor # macOS\n$ systemctl --user list-units | grep gh-token-monitor # Linux

\n\n

Step 2 — Check your GitHub footprint

\n\n

# Stolen-credential dead-drop repos use this exact description.\n$ gh search repos --owner @me 'Shai-Hulud: Here We Go Again'

\n\n

# The worm authors dead-drop commits as claude@users.noreply.github.com.\n$ gh search commits \\\n --author 'claude@users.noreply.github.com' \\\n --owner @me

\n\n

Step 3 — Run the interactive triage

\n\n

Before you click, ask yourself honestly: when did your build last run, and would you know if a fresh tarball had been pulled into it? The questions below take thirty seconds.

\n\n

Q1Did your CI or any developer machine run npm install against an affected scope between 2026-05-11 19:20 UTC and 2026-05-12 02:00 UTC?

\n \n \n

\n\n

Q2Do your lockfiles pin integrity hashes for the affected packages, with hash verification enforced in CI?

\n \n \n

\n\n

Q3Have you searched the affected hosts for router_init.js larger than 1 MB?

\n \n \n \n

\n\n

\n \n

\n\n

Indicators of compromise

\n\n

\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n

Type	Indicator
File	`router_init.js` — 2.3 MB obfuscated payload, sometimes renamed `router_runtime.js`
File	`setup.mjs` — Bun installer dropped under `~/.claude/` or `~/.vscode/`
Persistence	`~/.claude/settings.json` with a SessionStart hook re-executing the payload
Persistence	`~/.vscode/tasks.json` with a folderOpen task pointing at `setup.mjs`
Persistence	`~/Library/LaunchAgents/com.user.gh-token-monitor.plist` (macOS) or equivalent systemd unit (Linux)
SHA	`79ac49eedf774dd4b0cfa308722bc463cfe5885c` — orphan commit referenced by `optionalDependencies`
String	`Shai-Hulud: Here We Go Again` — description on public GitHub dead-drop repositories
String	`A Mini Shai-Hulud has Appeared` — description on worm-marker repositories
Commit author	`claude@users.noreply.github.com` on dead-drop commits
Branch name	Dune universe terms: `atreides`, `fremen`, `harkonnen`, `melange`, `sietch`, `sardaukar`, `stillsuit`, `thumper`, and others
Network	`filev2[.]getsession[.]org`, `seed1[.]getsession[.]org` – `seed3[.]getsession[.]org`
Network	`git-tanstack[.]com` (typosquat), `api[.]masscan[.]cloud`, `83[.]142[.]209[.]194`
CVE	`CVE-2026-45321`, CVSS 9.6, GHSA-g7cv-rxg3-hmpx

\n\n

If any of these turn up, isolate the host, image it forensically, then rotate credentials in this order: npm tokens, GitHub personal access tokens, cloud keys (AWS, GCP, Azure), Vault tokens, Kubernetes service accounts, SSH keys.

\n\n \n

Prevention

The control that closes each gap.

Provenance attestations and trusted publishing are still better than long-lived static tokens. Endor Labs' Peyton Kennedy put it bluntly to VentureBeat: the actual control that matters here is OIDC scope, not provenance and not 2FA. The checklist below works through the six gaps Mini Shai-Hulud exploited.

\n\n

Mini Shai-Hulud was detected six minutes after publish, and the affected versions were deprecated within hours. A three-day minimum-age policy in your package manager would have made every affected version unreachable. Each manager calls the feature something different and measures time in a different unit; the five configs below all enforce the same three-day cooldown.

\n\n

\n \n \n \n \n \n

\n\n

File ~/.npmrc · npm 11.10.0+ · unit: days

min-release-age=3

Applies to both npm install and npm ci. Cannot be combined with --before in the same invocation — npm errors out if both are present. npm CLI 12 is expected to make a cooldown the default; setting it explicitly now keeps your config future-proof.

\n\n

File pnpm-workspace.yaml · pnpm 10.16+ · unit: minutes

minimumReleaseAge: 4320\nminimumReleaseAgeExclude:\n - '@yourorg/*'

4320 minutes = 3 days. pnpm 11 turns this on by default at 1440 minutes (1 day). The minimumReleaseAgeExclude list takes glob patterns and exact locators like nx@21.6.5 — the place to keep your internal scope flowing while gating the public registry.

\n\n

File .yarnrc.yml · Yarn 4.10.0+ · unit: duration string

npmMinimalAgeGate: \"3d\"\nnpmPreapprovedPackages:\n - \"@yourorg/*\"\nenableScripts: false

Yarn accepts duration strings like \"3d\", \"72h\", or numeric minutes — all equivalent. npmPreapprovedPackages accepts both globs and exact locators, more flexible than the other managers. enableScripts: false is the lifecycle-script equivalent of npm ci --ignore-scripts.

\n\n

File bunfig.toml · Bun 1.3+ · unit: seconds

[install]\nminimumReleaseAge = 259200

259200 seconds = 3 days. Bun disables lifecycle scripts by default, so the age gate is the main install-time control to add. Use --minimum-release-age 259200 on the CLI for one-off overrides. Worth noting: the Mini Shai-Hulud payload itself ran under Bun specifically to evade Node-process monitoring — a fact that does not change the value of using Bun for your own installs, but is darkly funny.

\n\n

File ~/.config/uv/uv.toml · Python · unit: duration string

exclude-newer = \"3 days\"

The May 2026 wave hit PyPI as well as npm (guardrails-ai, mistralai, more). uv accepts relative durations natively. pip users can approximate this with pip install --uploaded-prior-to $(date -u -d '3 days ago' +%Y-%m-%dT%H:%M:%SZ), but uv is the better target if you can move to it.

\n\n

One gotcha — bots can still race the cooldown

The age gate is enforced at install time, not at update-suggestion time. If you use Renovate or Dependabot, configure their cooldown independently or they will keep opening PRs against versions your local install will refuse. Renovate's config:best-practices preset already sets a 3-day default for npm; Dependabot's equivalent is cooldown.default-days.

\n\n

\n Once attackers gain access to publishing workflows and pipeline identities, the software delivery process itself becomes the distribution mechanism.\n — Avital Harel, Upwind, May 12 2026\n

\n\n \n

The arc of the worm

From a graduate-student error to a CI/CD distribution mechanism.

Self-replicating malware is older than the World Wide Web. Each generation has run on the era's most-trusted plumbing. The Internet itself in 1988. Email in the early 2000s. Now the package registries that every developer has open in another tab.

\n\n

November 2, 1988

The Morris Worm

At around 8:30 p.m. on November 2, a Cornell graduate student named Robert Tappan Morris released a self-replicating program from an MIT computer. Within twenty-four hours roughly 6,000 of the 60,000 machines then connected to the Internet had been hit. Morris exploited a backdoor in sendmail, a buffer overflow in the finger daemon, and weak passwords. A design choice to re-infect 14% of the time regardless of an already-infected response turned a thought experiment into a denial-of-service event.

The worm goes open-source

Late on May 12, the malware research collective vx-underground reported that the fully weaponised Shai-Hulud worm code had been open-sourced. If confirmed, the attack is no longer limited to TeamPCP. Any actor with a target list and a misconfigured CI/CD pipeline can now reproduce the cache-poisoning, OIDC-extraction, and provenance-attested publishing chain.

\n\n

\n The Morris Worm was a wake-up call for the country and the cyber age to come. Each generation since has had its own.\n — After the FBI, on the 1988 attack\n

\n\n \n

Read further

Community-maintained tools referenced by Snyk: GLPMC/Tanstack-Worm-Detector and omarpr/mini-shai-hulud-ioc-scanner. Useful as a quick second opinion. Always verify before running.

\n Search github.com\n

\n\n

\n\n \n

\n \n

Stay current

The next wave is already being written. Subscribe to a feed, not a memory.

Every Shai-Hulud variant since September 2025 has reused tradecraft from the one before it. The mitigations stay the same; the access vectors get more interesting. Wire a real advisory feed into your build alerts and rehearse the response.

\n \n \n

\n\n

\n\n\n","scrollScripts",[194],"\n(function() {\n 'use strict';\n\n // ----- Theme toggle -----\n var root = document.getElementById('scroll-root');\n var toggle = document.getElementById('theme-toggle');\n\n function setTheme(isLight) {\n window.__scrollLight = isLight;\n if (isLight) {\n root.classList.remove('dark');\n toggle.setAttribute('aria-pressed', 'false');\n } else {\n root.classList.add('dark');\n toggle.setAttribute('aria-pressed', 'true');\n }\n }\n // default light\n setTheme(true);\n toggle.addEventListener('click', function() {\n setTheme(!window.__scrollLight);\n });\n\n // ----- Smooth scroll on nav buttons -----\n var navButtons = document.querySelectorAll('#nav-links button');\n navButtons.forEach(function(btn) {\n btn.addEventListener('click', function() {\n var target = document.getElementById(btn.getAttribute('data-target'));\n if (target) {\n var y = target.getBoundingClientRect().top + window.pageYOffset - 110;\n window.scrollTo({ top: y, behavior: 'smooth' });\n }\n });\n });\n\n // ----- Scroll-spy with IntersectionObserver -----\n var sections = document.querySelectorAll('section[id]');\n var spyObserver = new IntersectionObserver(function(entries) {\n entries.forEach(function(entry) {\n if (entry.isIntersecting) {\n var id = entry.target.getAttribute('id');\n navButtons.forEach(function(b) {\n if (b.getAttribute('data-target') === id) {\n b.classList.add('active');\n } else {\n b.classList.remove('active');\n }\n });\n }\n });\n }, { rootMargin: '-40% 0px -50% 0px', threshold: 0 });\n sections.forEach(function(s) { spyObserver.observe(s); });\n\n // ----- Fade-up on scroll -----\n var fadeEls = document.querySelectorAll('.fade-up');\n var fadeObserver = new IntersectionObserver(function(entries) {\n entries.forEach(function(entry) {\n if (entry.isIntersecting) {\n entry.target.classList.add('visible');\n fadeObserver.unobserve(entry.target);\n }\n });\n }, { threshold: 0.12, rootMargin: '0px 0px -60px 0px' });\n fadeEls.forEach(function(el) { fadeObserver.observe(el); });\n // Fallback: if IntersectionObserver doesn't fire (e.g. reduced motion), show all after a beat\n setTimeout(function() {\n fadeEls.forEach(function(el) { el.classList.add('visible'); });\n }, 1200);\n\n // ----- Copy-to-clipboard -----\n var copyButtons = document.querySelectorAll('.cmd-copy');\n copyButtons.forEach(function(btn) {\n btn.addEventListener('click', function() {\n var text = btn.getAttribute('data-copy') || '';\n // navigator.clipboard may be unavailable; fall back to textarea trick\n var success = false;\n try {\n if (navigator.clipboard && navigator.clipboard.writeText) {\n navigator.clipboard.writeText(text).then(function() {\n flashCopied(btn);\n });\n return;\n }\n } catch (e) { /* fallthrough */ }\n try {\n var ta = document.createElement('textarea');\n ta.value = text;\n ta.style.position = 'fixed';\n ta.style.left = '-9999px';\n document.body.appendChild(ta);\n ta.select();\n document.execCommand('copy');\n document.body.removeChild(ta);\n success = true;\n } catch (e) { success = false; }\n if (success) flashCopied(btn);\n });\n });\n function flashCopied(btn) {\n var original = btn.textContent;\n btn.textContent = 'Copied';\n btn.classList.add('copied');\n setTimeout(function() {\n btn.textContent = original;\n btn.classList.remove('copied');\n }, 1600);\n }\n\n // ----- Compromise checker logic -----\n var checkerState = { q0: null, q1: null, q2: null };\n var qBlocks = document.querySelectorAll('.checker-q-block');\n\n document.querySelectorAll('.checker-opt').forEach(function(opt) {\n opt.addEventListener('click', function() {\n var qBlock = opt.closest('.checker-q-block');\n var qIndex = parseInt(qBlock.getAttribute('data-q'), 10);\n // clear siblings\n qBlock.querySelectorAll('.checker-opt').forEach(function(o) {\n o.setAttribute('aria-checked', 'false');\n });\n opt.setAttribute('aria-checked', 'true');\n checkerState['q' + qIndex] = opt.getAttribute('data-value');\n // Reveal next, or finalise\n if (qIndex === 0) {\n if (checkerState.q0 === 'no') {\n // Skip directly to verdict (low)\n finaliseChecker();\n } else {\n showQ(1);\n }\n } else if (qIndex === 1) {\n showQ(2);\n } else if (qIndex === 2) {\n finaliseChecker();\n }\n });\n opt.addEventListener('keydown', function(e) {\n if (e.key === ' ' || e.key === 'Enter') {\n e.preventDefault();\n opt.click();\n }\n });\n });\n\n function showQ(i) {\n qBlocks.forEach(function(b) {\n var bi = parseInt(b.getAttribute('data-q'), 10);\n if (bi <= i) b.style.display = '';\n });\n var target = qBlocks[i];\n if (target) {\n setTimeout(function() {\n var y = target.getBoundingClientRect().top + window.pageYOffset - 120;\n window.scrollTo({ top: y, behavior: 'smooth' });\n }, 80);\n }\n }\n\n function finaliseChecker() {\n var result = document.getElementById('checker-result');\n var tag = document.getElementById('verdict-tag');\n var advice = document.getElementById('verdict-advice');\n var verdict = 'low', tagText = 'Likely clear', adviceText = '';\n\n if (checkerState.q0 === 'no') {\n verdict = 'low';\n tagText = 'Likely clear';\n adviceText = 'If no install ran during the window, you are very probably outside the blast radius for this specific wave. Still wire a real advisory feed into your build alerts — the same toolchain has produced five waves in eight months, and the next one will not announce itself.';\n } else if (checkerState.q2 === 'found') {\n verdict = 'high';\n tagText = 'Treat as compromised';\n adviceText = 'A router_init.js match means the payload reached your filesystem. Isolate the host immediately. Disable the gh-token-monitor daemon before revoking any tokens — the dead-man switch fires on revocation. Image the host forensically, then rotate npm tokens first, GitHub PATs next, cloud keys after that, and finally Vault, Kubernetes and SSH credentials reachable from the affected machine.';\n } else if (checkerState.q1 === 'no' && checkerState.q2 === 'no') {\n verdict = 'medium';\n tagText = 'Investigate now';\n adviceText = 'An install ran in the window and you have not yet completed the on-disk check. The 30-second action is to grep for the orphan-commit SHA in your lockfiles and find router_init.js on every affected host. Do that before you do anything else. The router_init.js check is the single fastest signal.';\n } else if (checkerState.q1 === 'yes' && checkerState.q2 === 'clean') {\n verdict = 'low';\n tagText = 'Likely clear';\n adviceText = 'Lockfile integrity enforcement is the control that breaks this attack quietly. Combined with a clean filesystem search, you are probably fine for this wave. Still rotate any tokens that were loaded into the runner during the window if you want belt-and-braces assurance.';\n } else if (checkerState.q1 === 'yes' && checkerState.q2 === 'no') {\n verdict = 'medium';\n tagText = 'Run the filesystem check';\n adviceText = 'Integrity verification protects new installs, but you have not confirmed your existing hosts are clean. Run the find and grep commands above before declaring this incident closed. Five minutes of grep is cheaper than reading the postmortem of the next wave.';\n } else {\n verdict = 'medium';\n tagText = 'Investigate further';\n adviceText = 'There is enough ambiguity in your answers that a sweep is the cheap move. Run the on-disk and GitHub search commands. If anything turns up, treat the host as compromised and follow the rotation order: isolate, disable persistence, image, then rotate npm, GitHub, cloud, Vault, K8s and SSH in that order.';\n }\n\n tag.className = 'checker-verdict ' + verdict;\n tag.textContent = tagText;\n advice.textContent = adviceText;\n result.classList.add('visible');\n setTimeout(function() {\n var y = result.getBoundingClientRect().top + window.pageYOffset - 120;\n window.scrollTo({ top: y, behavior: 'smooth' });\n }, 120);\n }\n\n document.getElementById('checker-reset').addEventListener('click', function() {\n checkerState = { q0: null, q1: null, q2: null };\n document.querySelectorAll('.checker-opt').forEach(function(o) {\n o.setAttribute('aria-checked', 'false');\n });\n qBlocks.forEach(function(b, i) {\n if (i > 0) b.style.display = 'none';\n });\n document.getElementById('checker-result').classList.remove('visible');\n var y = document.getElementById('checker').getBoundingClientRect().top + window.pageYOffset - 120;\n window.scrollTo({ top: y, behavior: 'smooth' });\n });\n\n // ----- Package manager tabs -----\n var pmTabs = document.querySelectorAll('.pm-tab');\n var pmPanels = document.querySelectorAll('.pm-panel');\n\n function activatePmTab(tab) {\n pmTabs.forEach(function(t) {\n t.setAttribute('aria-selected', 'false');\n t.setAttribute('tabindex', '-1');\n });\n pmPanels.forEach(function(p) { p.classList.remove('active'); });\n tab.setAttribute('aria-selected', 'true');\n tab.setAttribute('tabindex', '0');\n var panel = document.getElementById(tab.getAttribute('data-panel'));\n if (panel) panel.classList.add('active');\n }\n\n pmTabs.forEach(function(tab, idx) {\n tab.addEventListener('click', function() { activatePmTab(tab); });\n tab.addEventListener('keydown', function(e) {\n if (e.key === 'ArrowRight' || e.key === 'ArrowLeft') {\n e.preventDefault();\n var dir = e.key === 'ArrowRight' ? 1 : -1;\n var nextIdx = (idx + dir + pmTabs.length) % pmTabs.length;\n pmTabs[nextIdx].focus();\n activatePmTab(pmTabs[nextIdx]);\n } else if (e.key === 'Home') {\n e.preventDefault();\n pmTabs[0].focus();\n activatePmTab(pmTabs[0]);\n } else if (e.key === 'End') {\n e.preventDefault();\n pmTabs[pmTabs.length - 1].focus();\n activatePmTab(pmTabs[pmTabs.length - 1]);\n }\n });\n });\n\n // ----- Prevention checklist -----\n var checkItems = document.querySelectorAll('.check-item');\n var progressFill = document.getElementById('progress-fill');\n var progressCount = document.getElementById('progress-count');\n var total = checkItems.length;\n\n function updateProgress() {\n var done = 0;\n checkItems.forEach(function(it) {\n if (it.getAttribute('aria-checked') === 'true') done++;\n });\n var pct = (done / total) * 100;\n progressFill.style.width = pct + '%';\n progressCount.innerHTML = '' + done + '/' + total + ' controls';\n }\n\n checkItems.forEach(function(it) {\n function toggle() {\n var current = it.getAttribute('aria-checked') === 'true';\n it.setAttribute('aria-checked', current ? 'false' : 'true');\n updateProgress();\n }\n it.addEventListener('click', toggle);\n it.addEventListener('keydown', function(e) {\n if (e.key === ' ' || e.key === 'Enter') {\n e.preventDefault();\n toggle();\n }\n });\n });\n updateProgress();\n})();\n",{"_12":196,"_14":206},[197,200,203],{"_21":198,"_23":199},"Page","toolkit:mini-shai-halud",{"_21":201,"_23":202},"Post","post:35fa80b7-1924-8098-a9c4-c1b22e81f965",{"_21":204,"_23":205},"Blocks","post:35fa80b7-1924-8098-a9c4-c1b22e81f965:blocks",[],"actionData","errors"]

When the worm wears a trusted signature.

An identity attack dressed as a trusted release.

The class of attack

Why it matters

The three-link chain

A fork opens a draft PR

Poison crosses the boundary

OIDC token leaves the runner

Sigstore attests honestly

TeamPCP

2.3 MB obfuscated stealer

Three redundant channels

One compromised maintainer becomes a hundred.

The propagation loop

What the worm steals

Where it hides

The dead-man switch

The first hour matters more than the next ten.

Before you do anything else

Step 1 — Look for the payload on disk

Step 2 — Check your GitHub footprint

Step 3 — Run the interactive triage

Indicators of compromise

The control that closes each gap.

Pin id-token: write to the publish job onlyOIDC

Enforce lockfile integrity in CISRI

Set a minimum release age in every package managerCooldown

Remove pull_request_target from build workflowsTrigger

Stop trusting the GitHub Actions cache across boundariesCache

Disable lifecycle scripts in CI by defaultnpm

Monitor for optionalDependencies referencing orphan commitsProvenance

Use ephemeral, short-lived secrets in build runnersIdentity

Subscribe to a feed and rehearse the responseProcess

Minimum release age — copy-paste configs

One gotcha — bots can still race the cooldown

From a graduate-student error to a CI/CD distribution mechanism.

The Morris Worm

The Nx compromise

Shai-Hulud appears

Shai-Hulud 2.0 — The Second Coming

Shai-Hulud 3.0

TeamPCP attribution emerges

Mini Shai-Hulud at SAP

Mini Shai-Hulud — Here We Go Again

The worm goes open-source

Primary sources, advisories, and detection tooling.

TanStack npm supply-chain compromise

StepSecurity — Mini Shai-Hulud Is Back

Socket — TanStack npm packages compromised

Wiz — Mini Shai-Hulud strikes again

Snyk — TanStack npm packages hit by Mini Shai-Hulud

OX Security — 170+ packages hit across npm & PyPI

UpGuard — The Shai-Hulud attack explained

JFrog — Shai-Hulud: Here We Go Again

FBI — The Morris Worm

ReversingLabs — Shai-Hulud FAQ

Datadog — Shai-Hulud 2.0 IOCs

Community scanners

The next wave is already being written. Subscribe to a feed, not a memory.

Pin `id-token: write` to the publish job onlyOIDC

Remove `pull_request_target` from build workflowsTrigger

Monitor for `optionalDependencies` referencing orphan commitsProvenance

Related Items

Getting Started With Jira - Foundations

Claude and PowerBI

Copilot and Microsoft 365, Workflows & Governance

CSS Scroll-Margin-Top vs Scroll-Padding-Top

Developer Experience in an Age of AI

HTML-in-Canvas.dev

Modal vs Modeless, an exploration

PMI Northern Nevada PDD Special Edition - Getting Started With AI Governance