According to monitoring by Dongcha Beating, a worm named 'Mini Shai-Hulud' (the sandworm from 'Dune') is sweeping through the front-end and AI back-end ecosystems. The attacker TeamPCP hijacked the official release pipeline of TanStack between 3:20 and 3:26 AM (UTC+8) on May 12, pushing 84 malicious versions of 42 official packages to npm, including the widely downloaded `@tanstack/react-router`. The worm subsequently spread to PyPI, with the latest victims including Amazon's `@opensearch-project/opensearch` (npm, 1.3 million weekly downloads), the official Mistral client `mistralai`, and the AI guard tool `guardrails-ai` (both on PyPI). The malicious packages appear identical to legitimate releases. The attackers did not steal any long-term credentials but exploited a GitHub Actions configuration vulnerability to hijack the official pipeline, gaining legitimate temporary release permissions. As a result, the malicious packages received authentic SLSA build source signatures (provenance, a type of anti-counterfeiting label that proves 'the package was indeed produced by the official pipeline'). The developers' previously trusted logic of 'signed = safe' has been completely bypassed. Worse, uninstalling the malicious packages is far from sufficient. Reverse analysis by Socket.dev shows that once the worm is installed, it writes itself into the execution hooks of Claude Code (`.claude/settings.json`) and the task configuration of VS Code (`.vscode/tasks.json`). Even if the malicious packages are deleted, as long as the developer later opens the project directory or wakes up the AI assistant, the malicious code will automatically reactivate. The threshold for triggering on the Python side is even lower: developers don't even need to call any functions; simply `importing` the infected package will silently activate the spying. TeamPCP mockingly posted a message on the spoofed domain `git-tanstack[.]com` saying, 'We have been online stealing credentials for over two hours, but I'm just here to say hello :^)'. The worm continues to self-propagate. Machines that installed the affected packages during the aforementioned window should be treated as compromised: immediately rotate all credentials for AWS, GitHub, npm, SSH, etc., thoroughly check the `.claude/` and `.vscode/` directories, and reinstall from a clean lockfile.