Benjamin Read

The ongoing software supply chain campaign targeting the open source ecosystem reemerged on May 19th, affecting NPM packages, GitHub Actions, and a VSCode extension. The distributed malware was designed to harvest credentials, exfiltrate sensitive data, and establish persistent access on infected systems. As the activity unfolded publicly, Wiz Research independently observed related malicious activity in real time across developer and CI/CD environments.

On 11 May 2026, TeamPCP launched a coordinated supply chain attack against the npm ecosystem, compromising packages across multiple namespaces simultaneously. Impacted packages include: Packages in the  @tanstack namespace, which includes @tanstack/react-router, one of the most widely-used routing libraries in the React ecosystem with approximately 12 million weekly downloads.

A new supply chain attack calling itself “mini Shai Hulud” compromised SAP-related npm packages by injecting malicious preinstall scripts that execute during dependency installation. The campaign leverages a multi-stage payload to harvest developer and CI/CD secrets across GitHub, npm, and major cloud providers, and exfiltrates the data via attacker-controlled GitHub repositories. It also contains code designed to propagate via compromised tokens.