May 13th, 2026 × #Security#npm#Supply Chain#GitHub Actions
TanHacked
A brand new Shai-Hulud worm chewed through TanStack and a pile of other npm and PyPI packages using a poisoned GitHub Actions cache, complete with a dead man switch that wipes your home directory. Wes and Scott break down how it happened and how to protect yourself.
Wes Bos Host
Scott Tolinski Host
Scott and Wes break down the "Mini Shai-Hulud" supply chain attack that compromised TanStack and other popular npm packages through a clever GitHub Actions cache poisoning exploit; a self-propagating worm that stole credentials and persisted through Claude Code hooks and VS Code tasks. They also cover how developers can protect themselves using pnpm's security defaults, dev containers, and other practical defenses.
Show Notes
- 00:00 Welcome to Syntax!
- 00:25 Understanding the Shai-Hulud Worm
- 02:47 Mechanics of the Attack: GitHub Actions and Cache
- 05:44 Brought to you by Sentry.io
- 06:09 Propagation and Impact of the Worm
- 09:30 Preventative Measures for Developers
- 12:33 The Role of Package Managers in Security
- 18:39 Using Dev Containers
- 20:57 Conclusion and Final Thoughts
Hit us up on Socials!
Syntax: X Instagram Tiktok LinkedIn Threads
Wes: X Instagram Tiktok LinkedIn Threads
