Inside Mini Shai-Hulud: The Self-Propagating Supply-Chain Worm

The May 2026 TanStack npm compromise affecting 42 packages was part of Mini Shai-Hulud, a self-propagating supply-chain worm that uses developer machines and CI/CD pipelines as stepping stones to compromise subsequent packages and maintainers. This represents a critical evolution in supply-chain attacks—rather than isolated breaches, attackers exploit the ecosystem to spread automatically. Understanding how GitHub Actions cache poisoning and OIDC token extraction enabled this worm-like propagation is essential for developers to secure their release pipelines.