tanstack-shield

🛡️ tanstack-shield 원-커맨드 공급망 공격 스캐너 for CVE-2026-45321 / GHSA-g7cv-rxg3-hmpx 2026년 5월 11일 42개의 @tanstack/ npm 패키지84개의 악성 버전를 손상시킨 "미니 샤이-훌루드" 웜을 탐지합니다. root@kitploit: 한 줄 — 프로젝트 스캔 curl -fsSL https://raw.githubusercontent.com/Caixa-git/tanstack-shield/main/tanstack-shield.sh | bash 특정 디렉토리 스캔 curl...

mini-shai-hulud-detector

迷你 Shai-Hulud 检测器 一键扫描器，用于检测 Mini Shai-Hulud npm 供应链攻击（CVE-2026-45321，CVSS 9.6）。 关键：在轮换令牌前先检测 该蠕虫会安装一个持久化守护进程（gh-token-monitor），一旦检测到凭据吊销，就会执行 rm -rf 。在确认该守护进程已被清除之前，请勿轮换你的 GitHub PAT 或 npm 令牌。 检测 → 移除守护进程 → 然后 再轮换。 使用方法 root@kitploit: curl -fsSL...

tanstack-compromise-checker

tanstack-compromise-checker ⚠️ 면책 조항: 이 도구는 제 개인적인 사용 사례를 위해 제작되었습니다. 모든 지표는 다음 권고 출처에서 파생되었습니다: GHSA-g7cv-rxg3-hmpx Snyk: TanStack npm 패키지 손상 StepSecurity: Mini Shai-Hulud 심층 분석 이 문서가 마지막으로 업데이트된 이후 새로운 IOC, 페이로드 변종 또는 공격자 인프라가 등장하면 감지되지 않습니다. 항상 최신 게시된 권고와 교차 확인하십시오. TanStack 공급망 손상CVE-2026-4532...

shai-scan

shai-scan npm 및 PyPI 공급망 손상 탐지를 위한 의존성 제로 CLI 스캐너 왜 필요한가? 2026년 5월 11일, 미니 샤이훌루드Mini Shai-Hulud CVE-2026-45321, GHSA-g7cv-rxg3-hmpx라는 자가 전파형 공급망 웜이 npm 생태계를 손상시켰습니다. TeamPCP일명 DeadCatx3, PCPcat, ShellForce, CipherForce에 의한 이 악성코드는 GitHub Actions OIDC 토큰을 탈취하여 유효한 SLSA Build Level 3 출처 증명을 가진 악성...

shai-hulud-scan

shai-hulud-scan Ein Claude Code-Skill, der Maschinen auf Anzeichen einer Kompromittierung IOCs durch den Mini-Shai-Hulud -Supply-Chain-Wurm CVE-2026-45321, CVSS 9.6 scannt. Was ist Mini Shai-Hulud? Ein sich selbst verbreitender Supply-Chain-Wurm, der am 11. Mai 2026 über 170 npm/PyPI-Pakete...

MAL-2026-5320 Malicious code in openai-mcp (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6c30f8b1a160c72529e2671b81be13ea671302e9bc3915ee84bd2212e0fdd5a3 The package name and module structure impersonate the official openai Python SDK the package even rewrites exported classes' module attribute to...

Malicious code in tiktoken-mcp (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ac746100211f13951c190e98140c6948be51d7be9257b2b26bcc9baef19be29f tiktoken-mcp impersonates the OpenAI-published tiktoken package: its METADATA copies the upstream Name/Summary, Author 'Shantanu Jain', Author-email...

Malicious code in coolbox (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c55bfdad112134e980af7568a9138be1e4b940f7bfbeebad2b0f85d9337a0f44 The wheel installs coolbox-setup.pth, a Python path-configuration file that Python auto-loads at every interpreter startup any python invocation...

Malicious code in pyphetools (PyPI)

The package pyphetools version 0.9.120 contains a malicious .pth file pyphetools-setup.pth that executes a Bun-based credential stealer on every Python startup via CPython's site.py exec mechanism. The payload downloads the Bun runtime from the official GitHub release page, then runs an obfuscate...

Malicious code in executor-engine (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7fee580000475783e657a2e66ca6a4a4bd4369aa0bc9f87152b003dca6f34848 executor-engine 0.3.4 ships a malicious site-packages.pth file executorengine-setup.pth that Python's site initialization auto-executes on every...

Malicious code in phenopacket-store-toolkit (PyPI)

The package phenopacket-store-toolkit version 0.1.7 contains a malicious .pth file phenopacketstoretoolkit-setup.pth that executes a Bun-based credential stealer on every Python startup via CPython's site.py exec mechanism. The payload downloads the Bun runtime from the official GitHub release...

MAL-2026-5282 Malicious code in mrbios (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8d1c97dced5d8f917e2e9901e0ed99fb0034bfafb5a3d46ad47eeba76a883c57 The package installs mrbios-setup.pth into site-packages. Python auto-loads.pth files at every interpreter startup, so the contained payload runs...

MAL-2026-5300 Malicious code in funcdesc (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4a5756a79331cdda67721e39889609f5c0b5e342b678dbce2de97c94ec2dbe29 The package installs funcdesc-setup.pth, which Python auto-executes at interpreter startup for any environment where this package is installed. The.p...

MAL-2026-5148 Malicious code in @redhat-cloud-services/vulnerabilities-client (npm)

Part of the "Mini Shai-Hulud" supply chain worm campaign that compromised the GitHub Actions OIDC trusted publisher shared by Red Hat Cloud Services npm packages. The attacker injected a preinstall hook into this and 31 other packages in the @redhat-cloud-services scope. The hook delivers a...

MAL-2026-5144 Malicious code in @redhat-cloud-services/notifications-client (npm)

Part of the "Mini Shai-Hulud" supply chain worm campaign that compromised the GitHub Actions OIDC trusted publisher shared by Red Hat Cloud Services npm packages. The attacker injected a preinstall hook into this and 31 other packages in the @redhat-cloud-services scope. The hook delivers a...

GitHub Breached — Employee Device Hack Led to Exfiltration of 3,800+ Internal Repos

GitHub on Tuesday said it's investigating unauthorized access to its internal repositories after the notorious threat actor known as TeamPCP listed the platform's source code and internal organizations for sale on a cybercrime forum. "While we currently have no evidence of impact to customer...

Malicious code in @starmind/collector-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 33a028c205d18a30d3ff150b1653336fefa0ac86a6e5242811b6fb2c3283af21 The package @starmind/collector-cli was found to contain malicious code. Source: ghsa-malware...

Malicious code in @antv/gi-cli (npm)

Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...

Malicious code in @antv/l7-utils (npm)

Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...

Malicious code in @antv/x6-plugin-scroller (npm)

Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...