Children of Shai-Hulud: An Analysis of the The Evolution, Delivery and Spread of the TanStack Shai-Hulud Campaign

The recent detection of TanStack Router malware marks an evolution in the series of Dune-themed cyberattacks within the NPM ecosystem, notably following the Mini Shai-Hulud campaign that previously impacted PyTorch Lightning. This new variant exhibits enhanced capabilities, including an intricate encryption layer, a secrets collector updated to support AWS and AI tools, and a dynamic C2 architecture that evades traditional domain takedowns. The malware exploits GitHub Actions for spreading, bypassing npm installs, and leveraging GitHub's Trusted Publisher system. It achieves persistence through IDE hooks and is able to spread by simply opening a project in an IDE, such as VS Code or Claude Code. These upgrades have resulted in extensive compromise across various platforms, including TanStack, UiPath, and OpenSearch, with the potential for significant credential theft and further supply chain attacks. The attackers have demonstrated an iterative approach, learning from past defenses to craft more resilient and sophisticated methods of infiltration and persistence.