> ## Content Index
> Fetch the complete content index at: https://adjacent.media/llms.txt
> Use this file to discover other available public pages before exploring further.

# Major npm packages compromised in Mini Shai-Hulud supply chain attack
- URL: https://adjacent.media/signals/major-npm-packages-compromised-in-mini-shai-hulud-supply-chain-attack/
- Published: 2026-05-12T16:09:39.000Z
- Updated: 2026-05-12T16:09:39.000Z
- Description: The compromise of packages serving Mistral, UiPath, and TanStack (including react-router) shows how attackers can weaponize the dependency tree itself. When developers pull in trusted tools, they now pull in malicious code at scale.
- Author: Jonathan Greene
- Tags: #signal, theme-connected, infrastructure security, supply chain attack, package management

Source: [Socket](https://socket.dev/blog/tanstack-npm-packages-compromised-mini-shai-hulud-supply-chain-attack?ref=adjacent.media)

The compromise of packages serving Mistral, UiPath, and TanStack (including react-router) shows how attackers can weaponize the dependency tree itself. When developers pull in trusted tools, they now pull in malicious code at scale. Socket attributes the attack to the "Mini Shai-Hulud" campaign, suggesting coordinated targeting of high-visibility infrastructure packages. The attack surface isn't just enterprise software but the open-source foundations powering millions of applications simultaneously. Supply chain attacks have moved from theoretical risk to operational crisis for any organization using these ubiquitous libraries.