tanstack-shield

🛡️ tanstack-shield CVE-2026-45321 / GHSA-g7cv-rxg3-hmpx のためのワンコマンドサプライチェーン攻撃スキャナー 2026年5月11日に42の @tanstack/ npmパッケージ（84の悪意のあるバージョン）を侵害した「Mini Shai-Hulud」ワームを検出します。 root@kitploit: One line — scan your project curl -fsSL...

mini-shai-hulud-detector

迷你 Shai-Hulud 检测器 一键扫描器，用于检测 Mini Shai-Hulud npm 供应链攻击（CVE-2026-45321，CVSS 9.6）。 关键：在轮换令牌前先检测 该蠕虫会安装一个持久化守护进程（gh-token-monitor），一旦检测到凭据吊销，就会执行 rm -rf 。在确认该守护进程已被清除之前，请勿轮换你的 GitHub PAT 或 npm 令牌。 检测 → 移除守护进程 → 然后 再轮换。 使用方法 root@kitploit: curl -fsSL...

tanstack-compromise-checker

tanstack-compromise-checker ⚠️ 免责声明： 此工具是为我自己的使用场景而构建的。所有指标均来自以下通告源： GHSA-g7cv-rxg3-hmpx Snyk：TanStack npm 包遭入侵 StepSecurity：Mini Shai-Hulud 深度分析 如果在本次更新之后出现新的 IOC、负载变体或攻击者基础设施，它们将不会被检测到。请始终与最新发布的通告进行交叉核对。 检测本地项目检出中的 TanStack 供应链入侵（CVE-2026-45321）及相关 Mini Shai-Hulud 蠕虫工件。 该脚本旨在用于源代码检出、CI 作业和 Docke...

shai-scan

shai-scan 零依赖的 npm 和 PyPI 供应链受损检测 CLI 扫描器。 为什么？ 2026年5月11日，一种自传播的供应链蠕虫被命名为 Mini Shai-Hulud （CVE-2026-45321，GHSA-g7cv-rxg3-hmpx）入侵了 npm 生态系统。该恶意软件归因于 TeamPCP （又名 DeadCatx3、PCPcat、ShellForce、CipherForce），它劫持了 GitHub Actions OIDC 令牌，发布带有有效 SLSA Build Level 3 来源证明的恶意包。它窃取了 CI/CD 流水线、云提供商和加密货币钱包中的凭证，并...

shai-hulud-scan

shai-hulud-scan Ein Claude Code-Skill, der Maschinen auf Anzeichen einer Kompromittierung IOCs durch den Mini-Shai-Hulud -Supply-Chain-Wurm CVE-2026-45321, CVSS 9.6 scannt. Was ist Mini Shai-Hulud? Ein sich selbst verbreitender Supply-Chain-Wurm, der am 11. Mai 2026 über 170 npm/PyPI-Pakete...

MAL-2026-5320 Malicious code in openai-mcp (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6c30f8b1a160c72529e2671b81be13ea671302e9bc3915ee84bd2212e0fdd5a3 The package name and module structure impersonate the official openai Python SDK the package even rewrites exported classes' module attribute to...

Malicious code in tiktoken-mcp (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ac746100211f13951c190e98140c6948be51d7be9257b2b26bcc9baef19be29f tiktoken-mcp impersonates the OpenAI-published tiktoken package: its METADATA copies the upstream Name/Summary, Author 'Shantanu Jain', Author-email...

Malicious code in coolbox (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c55bfdad112134e980af7568a9138be1e4b940f7bfbeebad2b0f85d9337a0f44 The wheel installs coolbox-setup.pth, a Python path-configuration file that Python auto-loads at every interpreter startup any python invocation...

Malicious code in pyphetools (PyPI)

The package pyphetools version 0.9.120 contains a malicious .pth file pyphetools-setup.pth that executes a Bun-based credential stealer on every Python startup via CPython's site.py exec mechanism. The payload downloads the Bun runtime from the official GitHub release page, then runs an obfuscate...

Malicious code in executor-engine (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7fee580000475783e657a2e66ca6a4a4bd4369aa0bc9f87152b003dca6f34848 executor-engine 0.3.4 ships a malicious site-packages.pth file executorengine-setup.pth that Python's site initialization auto-executes on every...

Malicious code in phenopacket-store-toolkit (PyPI)

The package phenopacket-store-toolkit version 0.1.7 contains a malicious .pth file phenopacketstoretoolkit-setup.pth that executes a Bun-based credential stealer on every Python startup via CPython's site.py exec mechanism. The payload downloads the Bun runtime from the official GitHub release...

MAL-2026-5282 Malicious code in mrbios (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8d1c97dced5d8f917e2e9901e0ed99fb0034bfafb5a3d46ad47eeba76a883c57 The package installs mrbios-setup.pth into site-packages. Python auto-loads.pth files at every interpreter startup, so the contained payload runs...

MAL-2026-5300 Malicious code in funcdesc (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4a5756a79331cdda67721e39889609f5c0b5e342b678dbce2de97c94ec2dbe29 The package installs funcdesc-setup.pth, which Python auto-executes at interpreter startup for any environment where this package is installed. The.p...

MAL-2026-5148 Malicious code in @redhat-cloud-services/vulnerabilities-client (npm)

Part of the "Mini Shai-Hulud" supply chain worm campaign that compromised the GitHub Actions OIDC trusted publisher shared by Red Hat Cloud Services npm packages. The attacker injected a preinstall hook into this and 31 other packages in the @redhat-cloud-services scope. The hook delivers a...

MAL-2026-5144 Malicious code in @redhat-cloud-services/notifications-client (npm)

Part of the "Mini Shai-Hulud" supply chain worm campaign that compromised the GitHub Actions OIDC trusted publisher shared by Red Hat Cloud Services npm packages. The attacker injected a preinstall hook into this and 31 other packages in the @redhat-cloud-services scope. The hook delivers a...

GitHub Breached — Employee Device Hack Led to Exfiltration of 3,800+ Internal Repos

GitHub on Tuesday said it's investigating unauthorized access to its internal repositories after the notorious threat actor known as TeamPCP listed the platform's source code and internal organizations for sale on a cybercrime forum. "While we currently have no evidence of impact to customer...

Malicious code in @starmind/collector-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 33a028c205d18a30d3ff150b1653336fefa0ac86a6e5242811b6fb2c3283af21 The package @starmind/collector-cli was found to contain malicious code. Source: ghsa-malware...

Malicious code in @antv/gi-cli (npm)

Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...

Malicious code in @antv/l7-utils (npm)

Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...

Malicious code in @antv/x6-plugin-scroller (npm)

Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...