Follow your favourite podcasts, listen offline and in the car with CarPlay and Android Auto, and always pick up where you left off. Free to try.
Scott and Wes break down the “Mini Shai-Hulud” supply chain attack that compromised TanStack and other popular npm packages through a clever GitHub Actions cache poisoning exploit; a self-propagating worm that stole credentials and persisted through Claude Code hooks and VS Code tasks. They also cover how developers can protect themselves using pnpm’s security defaults, dev containers, and other practical defenses.
Show Notes
00:00 Welcome to Syntax!
00:25 Understanding the Shai-Hulud Worm
Post Mortem of Shai Hulud Attack
02:47 Mechanics of the Attack: GitHub Actions and Cache
