{"version":"1.0","type":"card","id":"ff9999df-159a-4067-8ac9-32d144b2f000","url":"https://stacklist.com/card/ff9999df-159a-4067-8ac9-32d144b2f000","title":"TanStack npm Packages Compromised in Ongoing Mini Shai-Hulud Supply-Chain Attack","source_url":"https://socket.dev/blog/tanstack-npm-packages-compromised-mini-shai-hulud-supply-chain-attack","note":"Socket detected 84 compromised TanStack npm package artifacts modified with suspected CI credential-stealing malware. This ongoing supply-chain attack raises significant concerns about security in the npm ecosystem.","image":{"url":"https://ucarecdn.com/42f7bbd0-e997-4689-bcbb-eb58857f7170/","alt":"TanStack npm Packages Compromised in Ongoing Mini Shai-Hulud Supply-Chain Attack","width":1200,"height":630},"stack":{"id":"4e9a6b47-d2ca-4b21-8344-f70c4f000e5e","title":"Signals Served #011 — The Atoms Get Their Round","url":"https://stacklist.com/c/finance/stack/4e9a6b47-d2ca-4b21-8344-f70c4f000e5e"},"created_at":"2026-05-26T23:59:22.293Z","updated_at":null,"aco":{"summary":"TrapDoor crypto stealer is a supply chain attack that compromised 36 malicious packages across npm, PyPI, and Crates.io, targeting developers working in crypto, DeFi, AI, and security. The attack, discovered by the Socket Research Team, affected hundreds of package versions across multiple open-source ecosystems.","tags":["supply-chain-attack","crypto-stealer","npm","pypi","crates-io","malware","open-source-security"],"key_entities":[{"name":"TrapDoor Crypto Stealer","type":"concept","confidence":0.98},{"name":"Socket Research Team","type":"organization","confidence":0.95},{"name":"npm","type":"technology","confidence":0.97},{"name":"PyPI","type":"technology","confidence":0.97},{"name":"Crates.io","type":"technology","confidence":0.97},{"name":"supply-chain attack","type":"concept","confidence":0.98},{"name":"DeFi","type":"concept","confidence":0.85}],"classification":"analysis","language":"en","confidence":0.85,"provenance":{"model":"claude-opus-4-6","tool":"@stacklist/mcp-server@2.0.0","confidence":0.85,"timestamp":"2026-05-26T23:59:29.456Z"},"token_counts":{"approximate":80,"cl100k":75},"content_hash":"sha256:88a2caec80e70a653b909a40a98cb6e07a81514491fcf2c112744966f213532b","acp_version":"0.2","body_available":true,"body_tokens":80,"visibility":"public","agent_accessible":true,"status":"final"},"_links":{"self":"/api/public/card/ff9999df-159a-4067-8ac9-32d144b2f000.json","html":"https://stacklist.com/card/ff9999df-159a-4067-8ac9-32d144b2f000","md":"/api/public/card/ff9999df-159a-4067-8ac9-32d144b2f000.md","stack_json":"/api/public/stack/4e9a6b47-d2ca-4b21-8344-f70c4f000e5e.json"}}