safe-action
MAL-2026-3590
npmmalware5/12/2026
Description
Malicious code in safe-action (npm)
Indicators of Compromise
SHA256 Hashes (2)
dd0e257c2958e16d803f002f996ebb83aae4ecc32bf71320bf985b936996e634
5e1924464368f0c5816ee84e000cc47017f44045140feafbbc9e685d847ed5a5
Domains (4)
git-tanstack.comfilev2.getsession.orgapi.masscan.cloudseed1.getsession.org
References (6)
https://github.com/advisories/GHSA-w3x2-675q-gpfqOSVhttps://www.aikido.dev/blog/mini-shai-hulud-is-back-tanstack-compromisedOSVhttps://www.stepsecurity.io/blog/mini-shai-hulud-is-back-a-self-spreading-supply-chain-attack-hits-the-npm-ecosystemOSVhttps://socket.dev/blog/tanstack-npm-packages-compromised-mini-shai-hulud-supply-chain-attackOSVhttps://tanstack.com/blog/npm-supply-chain-compromise-postmortemOSVhttps://snyk.io/blog/tanstack-npm-packages-compromised/OSV
Details
Ecosystemnpm
Attack Typemalware
Published5/12/2026
Aliases
GHSA-w3x2-675q-gpfq
Quick Actions