
> May 2026 · 8 min read
TanStack's npm Meltdown: Mini Shai-Hulud Worm Hits 42 Packages
On May 11 a sneaky PR and GitHub Actions cache poisoning turned TanStack Router into a credential-stealing supply-chain worm. Here's the play-by-play (and why your CI/CD just got a Dune-sized reality check).







