TanStack npm attack entered through trusted publishing

The Shai-Hulud worm published dozens of official @tanstack/* packages on May 11, 2026 by abusing the project's legitimate OIDC trusted publishing workflow, producing authentic Sigstore signatures. Analysis shows OIDC blocks token theft but not CI runner compromise or malicious postinstall dependencies.

• The worm injected itself into packages, bumping versions by exactly +3
• Sigstore bundles were genuinely issued by Fulcio and logged in Rekor
• Only 21.4% of the 51,370 most-downloaded packages use trusted publishing
• 8 of 10 analyzed attacks had exposure windows under a week