Hostile 92% javascript Download

@tanstack/react-start 1.167.68

Mini Shai-Hulud scoped setup dead-dropConcealed daemon targets editor-agent autorun configs
SHA-256dbf732c4b74fddff5775f0ef49eeb1e6d3dea508485c58ee0594bd4683ec7542
URLhttps://registry.npmjs.org/@tanstack/react-start/-/react-start-1.167.68.tgz
MaleculeK₃(McAmLi)O₇(CoPCa₃ErSAs₅Dy)H₆(Po₄Cm₁₁CrDb₁₄F₄Os₆)Md₃(InPa₈)

Also flagged by https://falhumaid.github.io/DFIR_Radar_RSS/rss.xml (Analyse de l’attaque de la supply chain TanStack), https://feeds.feedburner.com/TheHackersNews (CrowdSec Says TanStack npm Attack Led to Copy of 170 Private GitHub Repositories), osv (MAL-2026-3468: Malicious code in @tanstack/react-start (npm)) +3 more.

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.