{
  "type": "URL",
  "indicator": "http://git-tanstack.com/tmp/transformers.pyz",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "http://git-tanstack.com/tmp/transformers.pyz",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 4357178020,
      "indicator": "http://git-tanstack.com/tmp/transformers.pyz",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 3,
      "pulses": [
        {
          "id": "6a12fbc0117778eaba6e378a",
          "name": "EbeeMay2026 Pt3",
          "description": "Multiple APT/threat actors, Malware and Campaigns",
          "modified": "2026-05-24T13:23:12.428000",
          "created": "2026-05-24T13:23:12.428000",
          "tags": [
            "filehashsha256",
            "filehashmd5",
            "filehashsha1",
            "rnuarbvf url",
            "z5brjsogj789",
            "da6ah3",
            "goceqc6sk"
          ],
          "references": [],
          "public": 1,
          "adversary": "Seedworm, Amadey Botnet, Sorry, Leveraging Rclone, Campaign Abuses Google Tag Manager",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "IMEBEEIMFINE",
            "id": "343873",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "IPv4": 84,
            "URL": 63,
            "CVE": 21,
            "FileHash-MD5": 204,
            "FileHash-SHA1": 197,
            "FileHash-SHA256": 220,
            "domain": 122,
            "email": 13,
            "hostname": 99
          },
          "indicator_count": 1023,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 39,
          "modified_text": "6 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6a099f8446d58b4203386ce1",
          "name": "TeamPCP supply chain attack hits TanStack",
          "description": "On May 11, 2026, a significant supply chain attack attributed to TeamPCP targeted TanStack, compromising 84 malicious versions of 42 npm packages. This attack utilized the pull_request_target feature of GitHub Actions without modifying the publish workflow or stealing npm tokens directly. Instead, it executed a sophisticated chain of three vulnerabilities in the Continuous Integration/Continuous Deployment (CI/CD) pipeline: abuse of the pull_request_target trigger, cache poisoning within GitHub Actions, and extraction of an OIDC token from the GitHub Actions runner's memory.",
          "modified": "2026-05-17T10:59:16.053000",
          "created": "2026-05-17T10:59:16.053000",
          "tags": [
            "github actions",
            "mini shaihulud",
            "github",
            "tanstack",
            "teampcp",
            "oidc",
            "cicd",
            "shaihulud",
            "linux github",
            "oidc token",
            "level",
            "april",
            "malicious",
            "cloud",
            "persistence"
          ],
          "references": [
            "https://www.threatlocker.com/blog/teampcp-supply-chain-attack-hits-tanstack"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1003.007",
              "name": "Proc Filesystem",
              "display_name": "T1003.007 - Proc Filesystem"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1036",
              "name": "Masquerading",
              "display_name": "T1036 - Masquerading"
            },
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1195.001",
              "name": "Compromise Software Dependencies and Development Tools",
              "display_name": "T1195.001 - Compromise Software Dependencies and Development Tools"
            },
            {
              "id": "T1485",
              "name": "Data Destruction",
              "display_name": "T1485 - Data Destruction"
            },
            {
              "id": "T1528",
              "name": "Steal Application Access Token",
              "display_name": "T1528 - Steal Application Access Token"
            },
            {
              "id": "T1543.001",
              "name": "Launch Agent",
              "display_name": "T1543.001 - Launch Agent"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "PetrP.73",
            "id": "154605",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 2,
            "FileHash-SHA1": 3,
            "FileHash-SHA256": 4,
            "IPv4": 1,
            "URL": 2,
            "domain": 1,
            "hostname": 1
          },
          "indicator_count": 14,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 540,
          "modified_text": "13 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6a04333a1f4b0a7a6d4f7332",
          "name": "Mini Shai-Hulud Strikes Again: TanStack + more npm Packages Compromised",
          "description": "A recent coordinated supply chain attack, dubbed the Mini Shai-Hulud campaign, was executed by a threat actor group known as TeamPCP, targeting the npm and PyPi ecosystems on May 11, 2026. This attack compromised multiple high-value developer tools, particularly in the \n@tanstack\n and \n@uipath\n namespaces, with malicious versions of popular packages such as @tanstack/react-router and @uipath/apollo-core being among those affected. The attack was characterized by the exploitation of vulnerabilities in GitHub Actions, where the actor forked a legitimate repository, renamed it to evade detection, and subsequently executed malicious code that poisoned the GitHub Actions cache. This facilitated the extraction of OpenID Connect (OIDC) tokens from the GitHub Actions runners, enabling the unauthorized publication of the malicious package versions by bypassing npm credentials completely.",
          "modified": "2026-05-13T08:15:54.916000",
          "created": "2026-05-13T08:15:54.916000",
          "tags": [
            "research",
            "threat intel",
            "strong",
            "github",
            "github actions",
            "mini shaihulud",
            "teampcp",
            "pypi",
            "tanstack",
            "oidc",
            "cicd",
            "notable",
            "mini",
            "macos",
            "python",
            "lightning",
            "persistence",
            "footer",
            "cloud",
            "uipath"
          ],
          "references": [
            "https://www.wiz.io/blog/mini-shai-hulud-strikes-again-tanstack-more-npm-packages-compromised"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1041",
              "name": "Exfiltration Over C2 Channel",
              "display_name": "T1041 - Exfiltration Over C2 Channel"
            },
            {
              "id": "T1059.006",
              "name": "Python",
              "display_name": "T1059.006 - Python"
            },
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1195.001",
              "name": "Compromise Software Dependencies and Development Tools",
              "display_name": "T1195.001 - Compromise Software Dependencies and Development Tools"
            },
            {
              "id": "T1480.001",
              "name": "Environmental Keying",
              "display_name": "T1480.001 - Environmental Keying"
            },
            {
              "id": "T1485",
              "name": "Data Destruction",
              "display_name": "T1485 - Data Destruction"
            },
            {
              "id": "T1528",
              "name": "Steal Application Access Token",
              "display_name": "T1528 - Steal Application Access Token"
            },
            {
              "id": "T1543.001",
              "name": "Launch Agent",
              "display_name": "T1543.001 - Launch Agent"
            }
          ],
          "industries": [
            "Aerospace"
          ],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 1,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "PetrP.73",
            "id": "154605",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 2,
            "FileHash-SHA1": 5,
            "FileHash-SHA256": 4,
            "IPv4": 1,
            "URL": 2,
            "domain": 1
          },
          "indicator_count": 15,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 541,
          "modified_text": "17 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "https://www.wiz.io/blog/mini-shai-hulud-strikes-again-tanstack-more-npm-packages-compromised",
        "https://www.threatlocker.com/blog/teampcp-supply-chain-attack-hits-tanstack"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [
            "Seedworm, Amadey Botnet, Sorry, Leveraging Rclone, Campaign Abuses Google Tag Manager"
          ],
          "malware_families": [],
          "industries": [
            "Aerospace"
          ],
          "unique_indicators": 1031
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/git-tanstack.com",
    "whois": "http://whois.domaintools.com/git-tanstack.com",
    "domain": "git-tanstack.com",
    "hostname": "Unavailable"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 3,
  "pulses": [
    {
      "id": "6a12fbc0117778eaba6e378a",
      "name": "EbeeMay2026 Pt3",
      "description": "Multiple APT/threat actors, Malware and Campaigns",
      "modified": "2026-05-24T13:23:12.428000",
      "created": "2026-05-24T13:23:12.428000",
      "tags": [
        "filehashsha256",
        "filehashmd5",
        "filehashsha1",
        "rnuarbvf url",
        "z5brjsogj789",
        "da6ah3",
        "goceqc6sk"
      ],
      "references": [],
      "public": 1,
      "adversary": "Seedworm, Amadey Botnet, Sorry, Leveraging Rclone, Campaign Abuses Google Tag Manager",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "IMEBEEIMFINE",
        "id": "343873",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "IPv4": 84,
        "URL": 63,
        "CVE": 21,
        "FileHash-MD5": 204,
        "FileHash-SHA1": 197,
        "FileHash-SHA256": 220,
        "domain": 122,
        "email": 13,
        "hostname": 99
      },
      "indicator_count": 1023,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 39,
      "modified_text": "6 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6a099f8446d58b4203386ce1",
      "name": "TeamPCP supply chain attack hits TanStack",
      "description": "On May 11, 2026, a significant supply chain attack attributed to TeamPCP targeted TanStack, compromising 84 malicious versions of 42 npm packages. This attack utilized the pull_request_target feature of GitHub Actions without modifying the publish workflow or stealing npm tokens directly. Instead, it executed a sophisticated chain of three vulnerabilities in the Continuous Integration/Continuous Deployment (CI/CD) pipeline: abuse of the pull_request_target trigger, cache poisoning within GitHub Actions, and extraction of an OIDC token from the GitHub Actions runner's memory.",
      "modified": "2026-05-17T10:59:16.053000",
      "created": "2026-05-17T10:59:16.053000",
      "tags": [
        "github actions",
        "mini shaihulud",
        "github",
        "tanstack",
        "teampcp",
        "oidc",
        "cicd",
        "shaihulud",
        "linux github",
        "oidc token",
        "level",
        "april",
        "malicious",
        "cloud",
        "persistence"
      ],
      "references": [
        "https://www.threatlocker.com/blog/teampcp-supply-chain-attack-hits-tanstack"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1003.007",
          "name": "Proc Filesystem",
          "display_name": "T1003.007 - Proc Filesystem"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1036",
          "name": "Masquerading",
          "display_name": "T1036 - Masquerading"
        },
        {
          "id": "T1059.007",
          "name": "JavaScript",
          "display_name": "T1059.007 - JavaScript"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1195.001",
          "name": "Compromise Software Dependencies and Development Tools",
          "display_name": "T1195.001 - Compromise Software Dependencies and Development Tools"
        },
        {
          "id": "T1485",
          "name": "Data Destruction",
          "display_name": "T1485 - Data Destruction"
        },
        {
          "id": "T1528",
          "name": "Steal Application Access Token",
          "display_name": "T1528 - Steal Application Access Token"
        },
        {
          "id": "T1543.001",
          "name": "Launch Agent",
          "display_name": "T1543.001 - Launch Agent"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "PetrP.73",
        "id": "154605",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 2,
        "FileHash-SHA1": 3,
        "FileHash-SHA256": 4,
        "IPv4": 1,
        "URL": 2,
        "domain": 1,
        "hostname": 1
      },
      "indicator_count": 14,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 540,
      "modified_text": "13 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6a04333a1f4b0a7a6d4f7332",
      "name": "Mini Shai-Hulud Strikes Again: TanStack + more npm Packages Compromised",
      "description": "A recent coordinated supply chain attack, dubbed the Mini Shai-Hulud campaign, was executed by a threat actor group known as TeamPCP, targeting the npm and PyPi ecosystems on May 11, 2026. This attack compromised multiple high-value developer tools, particularly in the \n@tanstack\n and \n@uipath\n namespaces, with malicious versions of popular packages such as @tanstack/react-router and @uipath/apollo-core being among those affected. The attack was characterized by the exploitation of vulnerabilities in GitHub Actions, where the actor forked a legitimate repository, renamed it to evade detection, and subsequently executed malicious code that poisoned the GitHub Actions cache. This facilitated the extraction of OpenID Connect (OIDC) tokens from the GitHub Actions runners, enabling the unauthorized publication of the malicious package versions by bypassing npm credentials completely.",
      "modified": "2026-05-13T08:15:54.916000",
      "created": "2026-05-13T08:15:54.916000",
      "tags": [
        "research",
        "threat intel",
        "strong",
        "github",
        "github actions",
        "mini shaihulud",
        "teampcp",
        "pypi",
        "tanstack",
        "oidc",
        "cicd",
        "notable",
        "mini",
        "macos",
        "python",
        "lightning",
        "persistence",
        "footer",
        "cloud",
        "uipath"
      ],
      "references": [
        "https://www.wiz.io/blog/mini-shai-hulud-strikes-again-tanstack-more-npm-packages-compromised"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1041",
          "name": "Exfiltration Over C2 Channel",
          "display_name": "T1041 - Exfiltration Over C2 Channel"
        },
        {
          "id": "T1059.006",
          "name": "Python",
          "display_name": "T1059.006 - Python"
        },
        {
          "id": "T1059.007",
          "name": "JavaScript",
          "display_name": "T1059.007 - JavaScript"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1195.001",
          "name": "Compromise Software Dependencies and Development Tools",
          "display_name": "T1195.001 - Compromise Software Dependencies and Development Tools"
        },
        {
          "id": "T1480.001",
          "name": "Environmental Keying",
          "display_name": "T1480.001 - Environmental Keying"
        },
        {
          "id": "T1485",
          "name": "Data Destruction",
          "display_name": "T1485 - Data Destruction"
        },
        {
          "id": "T1528",
          "name": "Steal Application Access Token",
          "display_name": "T1528 - Steal Application Access Token"
        },
        {
          "id": "T1543.001",
          "name": "Launch Agent",
          "display_name": "T1543.001 - Launch Agent"
        }
      ],
      "industries": [
        "Aerospace"
      ],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 1,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "PetrP.73",
        "id": "154605",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 2,
        "FileHash-SHA1": 5,
        "FileHash-SHA256": 4,
        "IPv4": 1,
        "URL": 2,
        "domain": 1
      },
      "indicator_count": 15,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 541,
      "modified_text": "17 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "type": "URL",
    "indicator": "http://git-tanstack.com/tmp/transformers.pyz",
    "stats": {
      "malicious": 22,
      "suspicious": 1,
      "harmless": 43,
      "undetected": 27,
      "total": 93,
      "verdict": "malicious",
      "ratio": "22/93"
    },
    "verdict": "malicious",
    "ratio": "22/93",
    "final_url": "http://git-tanstack.com/tmp/transformers.pyz",
    "title": "",
    "reputation": 0,
    "tags": [],
    "top_detections": [
      {
        "vendor": "ADMINUSLabs",
        "result": "malicious",
        "category": "malicious"
      },
      {
        "vendor": "ArcSight Threat Intelligence",
        "result": "malware",
        "category": "malicious"
      },
      {
        "vendor": "BitDefender",
        "result": "malware",
        "category": "malicious"
      },
      {
        "vendor": "CRDF",
        "result": "malicious",
        "category": "malicious"
      },
      {
        "vendor": "Certego",
        "result": "malicious",
        "category": "malicious"
      },
      {
        "vendor": "Chong Lua Dao",
        "result": "malicious",
        "category": "malicious"
      },
      {
        "vendor": "CyRadar",
        "result": "malware",
        "category": "malicious"
      },
      {
        "vendor": "Dr.Web",
        "result": "malicious",
        "category": "malicious"
      },
      {
        "vendor": "ESET",
        "result": "phishing",
        "category": "malicious"
      },
      {
        "vendor": "ESTsecurity",
        "result": "malicious",
        "category": "malicious"
      }
    ],
    "last_analysis": 1778857414,
    "error": null
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "http://git-tanstack.com/tmp/transformers.pyz",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1780189908.2981591
}