Mini Shai-Hulud Strikes Again: TanStack + more npm Packages Compromised

A sophisticated supply chain attack by TeamPCP has compromised dozens of npm and PyPI packages—including TanStack and UiPath—deploying a credential-stealing worm that spreads across developer ecosystems, installs destructive persistence, and exfiltrates secrets via resilient, multi-channel C2 infrastructure.