Yesterday, between 19:20 and 19:26 UTC, six minutes of automated publishing destroyed the trust model of modern JavaScript development. In that window, 84 malicious package versions were pushed across 42 packages in the @tanstack namespace. Not by an attacker who stole a password. By TanStack's own legitimate release pipeline, using its own trusted identity, after attacker-controlled code hijacked the CI runner mid-workflow. @tanstack/react-router alone has 12.7 million weekly downloads. Within hours the worm had spread to Mistral AI's official npm SDK, UiPath, Guardrails AI, OpenSearch, and at least 170 packages across both npm and PyPI. Total cumulative downloads of affected packages: over 518 million. The repositories the attacker created to receive stolen credentials all contained the same string: “Shai-Hulud: Here We Go Again.” They named it after the Dune sandworm. The one that lives under the surface on planet Arrakis.…