← TanStack npm Supply Chain Attack (Mini Shai-Hulud / TeamPCP)reviewed 2026-10-17 · 24 claims checked
Fact-check findings
What an automated fact-checker found when it re-read TanStack npm Supply Chain Attack (Mini Shai-Hulud / TeamPCP) against the sources the page cites. Only the most recent review is shown.
Read this first
These findings are produced by an automated reviewer, and its results vary between runs: the same page, checked three times on the same day, came back with 15%, 20% and 34% of its claims disputed, mostly because each run extracted a different number of claims. Treat what follows as leads, not rulings.
“Disputed” means the reviewer could not reconcile the claim with the evidence it cited. It does not mean the claim is false. “Unverifiable” means no reachable source settled it either way.
Nothing here changes the page on its own. A proposed correction is applied only after a human moderator approves it; until then the page reads as it did when reviewed.
disputed
4 claimsThe reviewer could not reconcile the claim with the evidence it cited. This is a lead, not a ruling that the claim is false.
- #16[disputed][awaiting moderator]in section: Self-Propagation and Broader Campaign Impact
“Phoenix Security's aggregate tracking documented over 600 packages and 2,500+ compromised GitHub repositories across the full campaign as of early June 2026.”
reviewerPhoenix Security's aggregate tracking documented over 600 packages and 2,500+ compromised GitHub repositories across the full campaign as of early June 2026The 2,500+ repository figure is supported, but '600 packages' and 'as of early June' are not supported by the cited article, which is a May 19 report about the AntV wave specifically, not a campaign-wide aggregate.Proposed correction (not yet applied)Phoenix Security's analysis of the May 19, 2026 @antv wave documented 323 affected packages (645 malicious package-version artifacts) and over 2,500 GitHub repositories created using exfiltrated tokens — a figure specific to that wave, not a confirmed aggregate across the full campaign. - #17[disputed][awaiting moderator]in the timeline
“Phoenix Security reports aggregate campaign total of 600+ compromised packages and 2,500+ compromised GitHub repositories across all Mini Shai-Hulud / TeamPCP waves.”
reviewerPhoenix Security reports aggregate campaign total of 600+ compromised packages and 2,500+ compromised GitHub repositories across all Mini Shai-Hulud / TeamPCP waves (dated 2026-06-02)The timeline entry's date (2026-06-02) is not supported by the cited source, which is dated May 19 and scoped to one wave.Proposed correction (not yet applied)2026-05-19 - #18[disputed][awaiting moderator]in the timeline
“Phoenix Security reports aggregate campaign total of 600+ compromised packages and 2,500+ compromised GitHub repositories across all Mini Shai-Hulud / TeamPCP waves.”
reviewerPhoenix Security reports aggregate campaign total of 600+ compromised packages and 2,500+ compromised GitHub repositories across all Mini Shai-Hulud / TeamPCP waves (event text)Same underlying defect as the sections[4] Phoenix Security finding; grouped together.Proposed correction (not yet applied)Phoenix Security's analysis of the May 19 @antv wave reports 323 affected packages (645 malicious package-version artifacts) and 2,500+ compromised GitHub repositories; this is wave-specific, not a confirmed aggregate across all Mini Shai-Hulud / TeamPCP waves. - #22[disputed][awaiting moderator]in section: SLSA Provenance and Supply Chain Security Implications
“The Akamai research blog described the incident as evidence that 'valid attestations do not guarantee payload safety' and called it 'the first documented npm worm that produces validly-attested malicious packages.'”
reviewerAkamai described the incident with the direct quotes 'valid attestations do not guarantee payload safety' and called it 'the first documented npm worm that produces validly-attested malicious packages'This is a fabricated or misattributed direct quotation. The cited article discusses the same theme (SLSA attestation being forgeable/misleading) but does not contain either quoted sentence.Proposed correction (not yet applied)The Akamai research blog analyzed the attacker's ability to forge SLSA signature validation during the attack, underscoring that provenance attestations verify the build process rather than input integrity; AVOID.NET could not locate these exact quotations in the cited Akamai article.
unverifiable
1 claimNo source the reviewer could reach confirms or contradicts the claim.
- #6[unverifiable][awaiting moderator]in section: Threat Actor: TeamPCP and the Mini Shai-Hulud Campaign
“StepSecurity first attributed the TanStack attack to TeamPCP.”
reviewerStepSecurity first attributed the TanStack attack to TeamPCPConflates 'first to disclose the compromise' with 'first to attribute it to TeamPCP'; could not independently confirm the priority claim.
partially supported
5 claimsThe cited evidence supports part of the claim but not all of it.
- #3[partially supported][awaiting moderator]in the summary
“The campaign is the fourth documented wave from TeamPCP, a group active since at least late 2024, and represents the first recorded npm worm to produce validly-attested malicious packages under SLSA Build Level 3 provenance.”
reviewerTeamPCP has been active since at least late 2024, and the TanStack attack is its fourth documented waveThe 'fourth documented wave' framing is confirmed by the wave list elsewhere on the page. The founding-date claim is inconsistent both with outside reporting (Pluto Security dates the group's supply-chain pivot to Feb 2026) and with the page itself, which states in the Threat Actor section (without 'late') that the group has focused on supply-chain attacks 'since at least 2024' — a narrower, unhedged claim than the summary's 'late 2024'. Treat the precise origin date as unresolved. - #7[partially supported][awaiting moderator]in section: Threat Actor: TeamPCP and the Mini Shai-Hulud Campaign
“Unit 42 (Palo Alto Networks) separately documented a claimed partnership between TeamPCP and Vect ransomware operators, announced via BreachForums.”
reviewerUnit 42 documented a claimed partnership between TeamPCP and Vect ransomware operators, announced via BreachForumsThe underlying fact (a claimed Vect/TeamPCP partnership announced on BreachForums) is independently confirmed, but by Sophos and Check Point — not by the Unit 42 article actually cited for this sentence, which never mentions Vect. - #8[partially supported][awaiting moderator]in section: Threat Actor: TeamPCP and the Mini Shai-Hulud Campaign
“Prior waves include: Wave 1 (September 2025, 500+ packages), Wave 2 (November 2025, 492 packages affecting 700+ repositories), Wave 3 (April 2026, targeting SAP and Intercom ecosystems).”
reviewerPrior waves: Wave 1 (Sept 2025, 500+ packages), Wave 2 (Nov 2025, 492 packages/700+ repos), Wave 3 (April 2026, SAP and Intercom)Wave 3 (SAP/Intercom, April 2026) is independently corroborated by SecurityWeek and The Register. Waves 1 and 2 (500+ packages in Sept 2025; 492 packages/700+ repos in Nov 2025) could not be independently verified from a primary source in this review; no contradicting reporting was found either. - #14[partially supported][awaiting moderator]in section: Self-Propagation and Broader Campaign Impact
“More than 300 malicious package versions across 323 packages were published in a 22-minute automated burst via a compromised npm maintainer account.”
reviewerThe AntV wave on May 19, 2026 published 'more than 300' malicious package versions across 323 packages in a 22-minute burstThe package count (323) and the 22-minute window are both confirmed, but the version count is understated; both cited sources report roughly double the figure given on the page. - #19[partially supported][awaiting moderator]in the timeline
“Socket reports the 'Mini Shai-Hulud' campaign becomes active targeting npm and PyPI packages, including SAP and Intercom ecosystems.”
reviewerSocket reports Mini Shai-Hulud active from April 29, 2026 targeting npm/PyPI including SAP and Intercom ecosystemsThe underlying event is corroborated elsewhere (SecurityWeek, The Register), but the specific source cited for this timeline entry (Heise) only supports the SAP portion, not Intercom or PyPI.
confirmed
14 claimsThe cited evidence supports the claim as written.
- #1[confirmed][no action needed]in the summary
“On May 11, 2026, threat actor group TeamPCP executed a sophisticated supply chain attack against the TanStack npm ecosystem, compromising 42 packages across 84 malicious versions collectively downloaded millions of times per week.”
reviewerTeamPCP compromised 42 TanStack packages across 84 malicious versions on May 11, 2026Core facts confirmed directly against the TanStack postmortem and the GitLab CVE advisory mirror. - #2[confirmed][no action needed]in the summary
“The attack, branded internally as the 'Mini Shai-Hulud' worm, chained three GitHub Actions vulnerabilities to extract an OIDC token from runner memory and autonomously publish credential-stealing payloads that spread to over 170 additional npm and PyPI packages including Mistral AI, UiPath, and OpenSearch.”
reviewerThe attack chained three GitHub Actions vulnerabilities to steal an OIDC token and the worm spread to 170+ additional npm/PyPI packages including Mistral AI, UiPath and OpenSearchFigure is a reasonable rounding of Orca's 169 npm + 2 PyPI count; mechanism matches the TanStack postmortem's description of the three-stage exploit. - #4[confirmed][no action needed]in section: Overview and Scope
“CVE-2026-45321 (GHSA-g7cv-rxg3-hmpx, CVSS 9.6 Critical) was assigned to document the incident.”
reviewerCVE-2026-45321 / GHSA-g7cv-rxg3-hmpx / CVSS 9.6 Critical was assigned to the incidentConfirmed directly against the advisory. - #5[confirmed][no action needed]in section: Overview and Scope
“All 84 malicious versions were deprecated and removed from the npm registry by 23:55 UTC on May 11, 2026, approximately four and a half hours after initial publication.”
reviewerAll 84 malicious versions were removed from npm by 23:55 UTC on May 11, 2026, about four and a half hours after initial publicationConfirmed with precise timestamps from the primary source. - #9[confirmed][no action needed]in section: Threat Actor: TeamPCP and the Mini Shai-Hulud Campaign
“Separately, TeamPCP is attributed with compromising Aqua Security's Trivy vulnerability scanner in March 2026, followed by a breach of Checkmarx infrastructure, and the Bitwarden CLI npm package (version 2026.4.0) on April 22, 2026.”
reviewerTeamPCP compromised Aqua Security's Trivy scanner (March 2026), Checkmarx, and the Bitwarden CLI npm package v2026.4.0 (April 22, 2026)Confirmed against both sources. - #10[confirmed][no action needed]in section: Threat Actor: TeamPCP and the Mini Shai-Hulud Campaign
“The Bitwarden payload contained the string 'Shai-Hulud: The Third Coming', linking it explicitly to the campaign.”
reviewerThe Bitwarden payload contained the string 'Shai-Hulud: The Third Coming'Confirmed by two independent sources. - #11[confirmed][no action needed]in section: Attack Mechanism: Three-Chain GitHub Actions Exploit
“On May 10, 2026 at 17:16 UTC, an attacker controlled GitHub account created a fork of the TanStack router repository (github.com/zblgg/configuration) and added a malicious commit (65bf499d16a5e8d25ba95d69ec9790a6dd4a1f14) containing an approximately 30,000-line obfuscated JavaScript payload injected into packages/history/vite_setup.mjs.”
reviewerThe attacker forked TanStack/router on May 10, 2026 at 17:16 UTC (github.com/zblgg/configuration), adding a ~30,000-line obfuscated payload to vite_setup.mjsConfirmed against the primary postmortem timeline. - #12[confirmed][no action needed]in section: Attack Mechanism: Three-Chain GitHub Actions Exploit
“A 1.1 GB poisoned pnpm package store was saved to the cache at approximately 11:29 UTC, persisting across the fork-to-base trust boundary.”
reviewerA 1.1 GB poisoned pnpm cache entry was saved at approximately 11:29 UTC on May 11Confirmed. - #13[confirmed][no action needed]in section: Self-Propagation and Broader Campaign Impact
“In total, the Orca Security analysis counted 373 malicious package-version entries spanning 169 npm packages and 2 PyPI packages by the end of Wave 4.”
reviewerOrca Security counted 373 malicious package-version entries across 169 npm packages and 2 PyPI packagesExact match to the cited source. - #15[confirmed][no action needed]in section: Self-Propagation and Broader Campaign Impact
“On June 1, 2026, a further wave compromised 96 versions across 32 packages in the @redhat-cloud-services npm namespace. A Red Hat employee GitHub account was compromised and used to push malicious orphan commits to RedHatInsights repositories, bypassing standard code review.”
reviewerA June 1, 2026 wave compromised 96 versions across 32 Red Hat @redhat-cloud-services packages, ~80,000 weekly downloadsConfirmed; minor one-version discrepancy (95 vs 96) likely reflects differing snapshot times between trackers. - #20[confirmed][no action needed]in section: Known Affected Organizations and Downstream Impact
“OpenAI disclosed that two employee devices in their corporate environment were affected by the compromised TanStack packages.”
reviewerOpenAI disclosed two employee devices affected; no evidence end user data or production systems compromisedDevice count and quote independently confirmed via secondary reporting on OpenAI's statement; the 'no end user data or production systems compromised' portion of the claim could not be directly verified since the primary OpenAI source blocked automated access, but nothing contradicts it. - #21[confirmed][no action needed]in section: Known Affected Organizations and Downstream Impact
“Bitwarden confirmed its CLI package (version 2026.4.0) was trojanized for approximately 90 minutes on April 22, 2026. Bitwarden stated that no end-user vault data was accessed or put at risk, and that no production data or production systems were compromised.”
reviewerBitwarden CLI package v2026.4.0 trojanized for ~90 minutes on April 22, 2026; no end-user vault data at riskConfirmed. - #23[confirmed][no action needed]in section: SLSA Provenance and Supply Chain Security Implications
“This demonstrates that SLSA provenance attestations verify the build process, not the integrity of the inputs to or behavior of that process. The vulnerability was in the OIDC trust configuration: pinning only the repository (not the specific workflow file or branch) allowed the stolen OIDC token to mint valid attestations for any publish.”
reviewerSLSA Build Level 3 attestations verify build process, not input integrity; vulnerable OIDC config pinned only the repositoryThis is standard, independently-verifiable technical analysis consistent with the postmortem, separate from the fabricated Akamai quotes flagged above. - #24[confirmed][no action needed]in section: Self-Propagation and Broader Campaign Impact
“Confirmed secondary victims included: Mistral AI (@mistralai/mistralai versions 2.2.2–2.2.4), UiPath (65+ packages), OpenSearch, Guardrails AI (guardrails-ai 0.10.1 on PyPI), and a cluster of aviation tooling packages under the @squawk and @draftlab namespaces.”
reviewerMistral AI's @mistralai/mistralai npm package versions 2.2.2–2.2.4 were compromised secondary victimsUiPath count (65+) is close to Orca's reported 66 entries; OpenSearch and Guardrails AI are both independently confirmed. The @draftlab namespace claim could not be separately verified but was not contradicted.
How this fits together. The reviewer reads the published page and its cited sources and records one finding per claim. A human moderator decides whether each proposed correction is applied; those decisions, and the score changes they cause, appear in the audit log. Earlier review runs are not shown here; only the latest reflects the page as it stands.