launched inside a GitHub Actions runner read more about Popular GitHub Action Tags Redirected to Imposter Commit to Steal CI/CD Credentials

Socket researchers found a compromise in 84 npm package artifacts under the TanStack namespace that inserted a credential-stealing payload targeting GitHub Actions and other CI systems, with some malicious versions reaching more than 12 million weekly downloads. The campaign is tied to the Mini Shai-Hulud supply-chain operation and includes a malicious optional dependency, code execution during installation, and exfiltration over the Session infrastructure. #TanStack #MiniShaiHulud #GitHubActions #Session #npm