Hostile 92% javascript Download

@tanstack/react-start 1.167.71

Mini Shai-Hulud scoped setup dead-dropConcealed daemon targets editor-agent autorun configs
SHA-256266548435a54fb6582bd3c5d90f21cd20e971f20e9d3add3c2739eac46f2f848
URLhttps://registry.npmjs.org/@tanstack/react-start/-/react-start-1.167.71.tgz
MaleculeK₃(McAmLi)O₈(CoEuPErSAs₅Ca₂Dy)H₆(Po₄Cm₁₁CrDb₁₄F₄Os₆)Md₃(InPa₈)

Also flagged by https://falhumaid.github.io/DFIR_Radar_RSS/rss.xml (Analyse de l’attaque de la supply chain TanStack), https://feeds.feedburner.com/TheHackersNews (CrowdSec Says TanStack npm Attack Led to Copy of 170 Private GitHub Repositories), osv (MAL-2026-3468: Malicious code in @tanstack/react-start (npm)) +3 more.

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.