Hundreds of npm packages infected by the self-propagating, credential-stealing worm from TeamPCP are related to the open source TanStack ecosystem.
Worm Redux: Fresh Mini Shai-Hulud Infections Bite Supply Chain
Summary + source link. No paywalls, no tracking.