Self-Propagating Worm Infects Hundreds of npm Packages in TanStack Ecosystem Supply Chain Attack

Hundreds of npm packages were infected by a self-propagating, credential-stealing worm attributed to a threat actor identified as TeamPCP. The compromised packages are linked to the open-source TanStack ecosystem, a collection of libraries used for building web applications. The worm exhibits worm-like behavior, enabling it to spread autonomously across systems. No specific dates, CVE IDs, or technical indicators (e.g., hashes, IOCs) were provided in the reported details. The primary impact involves supply chain compromise through malicious npm dependencies, leading to potential credential theft and further propagation.