When OpenAI engineers discovered that a poisoned update to a widely used JavaScript library had executed on two corporate laptops, the company’s security team faced a decision that no software ...

On May 11, 2026, a self-replicating worm called Mini Shai-Hulud quietly slipped into 42 widely used TanStack open-source packages, corrupting 84 npm artifacts before anyone noticed. Within hours, the ...

Tanstack reports that three vulnerabilities were abused and chained together to upload the malicious versions. Disclosure: Ziff Davis, PCMag's parent company, filed a lawsuit against OpenAI in April ...

The TanStack software-supply chain attack illustrates a growing challenge under the EU AI Act: what evidence deployers should ...

GitHub says the hackers who breached 3,800 internal repositories gained access via a malicious version of the Nx Console VS Code extension, compromised in last week's TanStack npm supply-chain attack.

The Grafana data breach was caused by a single GitHub workflow token that slipped through the rotation process following the TanStack npm supply-chain attack last week. In the ongoing Shai-Hulud ...

Unlock the full InfoQ experience by logging in! Stay updated with your favorite authors and topics, engage with content, and download exclusive resources. Brian Martin discusses the real-world ...

A popular developer of open source analytics software has revealed that a recent data breach and extortion incident was caused by the Mini Shai-Hulud campaign which compromised TanStack packages.