Industry shifts, security alerts, hardware, and AI/ML Compiled for immediate developer deployment.
calendar_todaysummarizeWeek 20-2026bolt1 CRITICAL
article
Mini Shai-Hulud Is Back: npm Worm Hits over 160 Packages, Including Mistral and TanStack
TAG: SECURITY
Aikido Security's malware team detected 373 malicious package-version entries across 169 npm package names in a major supply-chain campaign dubbed Mini Shai-Hulud. Compromised namespaces include @tanstack (83 entries), @squawk (87), @uipath (66), @mistralai, @tallyui, and several unscoped packages. Unlike the earlier SAP-focused wave, this attack abuses GitHub Actions OIDC trusted publishing: a pull_request_target workflow poisoning injects router_init.js into package tarballs and adds an optional dependency pointing to a GitHub-hosted @tanstack/setup that runs a Bun-based payload via its prepare script. The payload steals GitHub tokens, npm tokens, OIDC tokens, AWS credentials, Kubernetes service account files, and HashiCorp Vault tokens, then uses stolen publish access to propagate itself into further packages. Developers who installed affected versions should immediately rotate all secrets from exposed machines and CI runners, and audit recent npm publish and GitHub Actions activity.
Exchange Server Zero-Day CVE-2026-42897 Can Be Triggered by Opening a Malicious Email
TAG: SECURITY
Microsoft has disclosed CVE-2026-42897, a cross-site scripting zero-day in Exchange Server's Outlook Web Access (OWA) that is already being actively exploited in the wild. Affected versions include Exchange Server 2016, 2019, and the Subscription Edition (SE); Exchange Online is unaffected. A specially crafted email, when opened in OWA under certain interaction conditions, can execute arbitrary JavaScript in the browser context. Microsoft has published an automatic mitigation through the Exchange Emergency Mitigation (EM) Service — administrators should verify that Mitigation M2 is active and enable EM Service if it was disabled. Admins with air-gapped or disconnected servers must manually run the Exchange on-premises Mitigation Tool (EOMT). Known side effects of the mitigation include broken OWA calendar printing and inline images not rendering correctly. A formal security patch is planned for Exchange SE RTM, 2016 CU23, and 2019 CU14/CU15, with no fixed release date announced.
Mistral AI SDK and TanStack Router Hit in npm Software Supply Chain Attack
TAG: SECURITY
The TeamPCP threat group executed a major npm and PyPI supply-chain attack on May 11, compromising over 170 packages within hours using the automated Mini Shai-Hulud malware platform. Affected packages include the full @tanstack ecosystem (42 packages), @squawk (87), @uipath (66), @tallyui (30), @beproduct (18), the Mistral AI SDK on both npm and PyPI, and the Guardrails AI PyPI package. The attack exploited a pull_request_target GitHub Actions misconfiguration to scrape short-lived OIDC tokens without ever stealing maintainer passwords. The payload deploys a destructive dead-man's switch: if a developer revokes a stolen GitHub token, the malware runs rm -rf on the user's entire home directory. SafeDep detected the compromise within six minutes. Recommended mitigations include checking lockfiles for known compromised versions, pinning dependencies to known-good versions, and immediately rotating all credentials active at the time of installation.
GitHub Copilot Individual Plans: Flex Allotments for Pro and Pro+, Plus a New Max Plan
TAG: AI TOOLS
Starting June 1, 2026, GitHub Copilot is restructuring its individual plans as usage-based billing goes live. The updated lineup spans Free, Pro ($10/month), Pro+ ($39/month), and a new Max tier ($100/month). Each paid plan now includes two credit buckets: base credits matched 1:1 to the subscription price, and a variable flex allotment on top — giving Pro users $15 total, Pro+ users $70, and Max users $200 in monthly included usage. Code completions and next-edit suggestions remain unlimited on all paid plans and do not consume credits. The flex allotment is designed to adjust over time as AI model pricing and efficiency evolve, while base credits are fixed. Existing Pro and Pro+ subscribers on monthly billing are migrated automatically on June 1 with no action required.
Vercel AI Gateway Production Index: How Real Teams Actually Use AI Models
TAG: AI
Vercel's AI Gateway, serving tens of trillions of tokens across 200K+ teams, reveals a stark divide between spend and volume in production AI workloads. In April 2026, Anthropic captured 61% of spend — driven by Claude Opus on quality-critical calls — while Google led on token volume at 38%, powered by cheap Gemini Flash for high-frequency tasks. Agentic workloads now account for 58.9% of all tokens (up from 31.6% in October 2025), yet only 22.2% of requests, because tool-call chains are roughly 2.6x more token-heavy than chat. High-scale teams averaging 10M+ requests use 35 distinct models on average, routing across a purpose-built fleet rather than relying on any single provider. Fallback rescues 3.5% of requests and 4.9% of spend, with the most expensive calls — long-context windows and multi-step agent runs — failing at disproportionately higher rates. The data signals that multi-model routing is now standard production architecture, not an advanced optimization.
5 Years and $5M Later: Inventing a New Programming Language for Web Dev Was a Mistake
TAG: INDUSTRY
Wasp co-founder Matija Sosic reflects on why building a custom DSL compiler in Haskell for a full-stack JavaScript framework was ultimately the wrong call after five years and $5M raised through Y Combinator. The language, designed to abstract common web-app patterns like auth, routing, and cron jobs into a high-level specification on top of React and Node.js, resonated with developers in principle but created persistent barriers: the wasp-lang name implied replacing JavaScript, Haskell branding confused positioning, and maintaining a language server and VS Code extension for a custom language proved far harder than anticipated. Crucially, the team discovered that Wasp's real moat was never the syntax — it was the compile-time, full-app-level understanding that makes both human reasoning and AI-assisted development more reliable. They are now replacing the custom language with a TypeScript SDK, preserving the same Wasp compiler internals while eliminating the adoption friction, with a TypeScript-first Launch Week imminent.
Why Does This Keep Happening? — The npm Mini Shai-Hulud Worm Explained
Wes Bos and Scott Tolinski break down the Mini Shai-Hulud npm supply-chain attack that compromised TanStack, Mistral AI SDK, UiPath, and dozens of other packages in May 2026. They explain the exact GitHub Actions exploit: attackers used pull_request_target to poison the PNPM store cache, then captured a legitimate OIDC token during a real release workflow to publish malicious versions without ever stealing a maintainer's password. The payload targeted AWS credentials, GitHub tokens, and even injected hooks into claude settings.json and VS Code tasks.json for persistence. The worm also installed a dead-man's switch that runs rm -rf on a developer's home directory if the stolen GitHub token is revoked. Practical mitigations discussed include pnpm's built-in minimum release age (24-hour delay), block-exotic-sub-deps in pnpm v11, Socket's npm scanner, and dev containers for filesystem isolation.
Mini Shai-Hulud Is Back: npm Worm Hits over 160 Packages, Including Mistral and TanStack
Aikido Security's malware team detected 373 malicious package-version entries across 169 npm package names in a major supply-chain campaign dubbed Mini Shai-Hulud. Compromised namespaces include @tanstack (83 entries), @squawk (87), @uipath (66), @mistralai, @tallyui, and several unscoped packages. Unlike the earlier SAP-focused wave, this attack abuses GitHub Actions OIDC trusted publishing: a pull_request_target workflow poisoning injects router_init.js into package tarballs and adds an optional dependency pointing to a GitHub-hosted @tanstack/setup that runs a Bun-based payload via its prepare script. The payload steals GitHub tokens, npm tokens, OIDC tokens, AWS credentials, Kubernetes service account files, and HashiCorp Vault tokens, then uses stolen publish access to propagate itself into further packages. Developers who installed affected versions should immediately rotate all secrets from exposed machines and CI runners, and audit recent npm publish and GitHub Actions activity.
Why Does This Keep Happening? — The npm Mini Shai-Hulud Worm Explained
Wes Bos and Scott Tolinski break down the Mini Shai-Hulud npm supply-chain attack that compromised TanStack, Mistral AI SDK, UiPath, and dozens of other packages in May 2026. They explain the exact GitHub Actions exploit: attackers used pull_request_target to poison the PNPM store cache, then captured a legitimate OIDC token during a real release workflow to publish malicious versions without ever stealing a maintainer's password. The payload targeted AWS credentials, GitHub tokens, and even injected hooks into claude settings.json and VS Code tasks.json for persistence. The worm also installed a dead-man's switch that runs rm -rf on a developer's home directory if the stolen GitHub token is revoked. Practical mitigations discussed include pnpm's built-in minimum release age (24-hour delay), block-exotic-sub-deps in pnpm v11, Socket's npm scanner, and dev containers for filesystem isolation.
Exchange Server Zero-Day CVE-2026-42897 Can Be Triggered by Opening a Malicious Email
Microsoft has disclosed CVE-2026-42897, a cross-site scripting zero-day in Exchange Server's Outlook Web Access (OWA) that is already being actively exploited in the wild. Affected versions include Exchange Server 2016, 2019, and the Subscription Edition (SE); Exchange Online is unaffected. A specially crafted email, when opened in OWA under certain interaction conditions, can execute arbitrary JavaScript in the browser context. Microsoft has published an automatic mitigation through the Exchange Emergency Mitigation (EM) Service — administrators should verify that Mitigation M2 is active and enable EM Service if it was disabled. Admins with air-gapped or disconnected servers must manually run the Exchange on-premises Mitigation Tool (EOMT). Known side effects of the mitigation include broken OWA calendar printing and inline images not rendering correctly. A formal security patch is planned for Exchange SE RTM, 2016 CU23, and 2019 CU14/CU15, with no fixed release date announced.
Mistral AI SDK and TanStack Router Hit in npm Software Supply Chain Attack
The TeamPCP threat group executed a major npm and PyPI supply-chain attack on May 11, compromising over 170 packages within hours using the automated Mini Shai-Hulud malware platform. Affected packages include the full @tanstack ecosystem (42 packages), @squawk (87), @uipath (66), @tallyui (30), @beproduct (18), the Mistral AI SDK on both npm and PyPI, and the Guardrails AI PyPI package. The attack exploited a pull_request_target GitHub Actions misconfiguration to scrape short-lived OIDC tokens without ever stealing maintainer passwords. The payload deploys a destructive dead-man's switch: if a developer revokes a stolen GitHub token, the malware runs rm -rf on the user's entire home directory. SafeDep detected the compromise within six minutes. Recommended mitigations include checking lockfiles for known compromised versions, pinning dependencies to known-good versions, and immediately rotating all credentials active at the time of installation.
GitHub Copilot Individual Plans: Flex Allotments for Pro and Pro+, Plus a New Max Plan
Starting June 1, 2026, GitHub Copilot is restructuring its individual plans as usage-based billing goes live. The updated lineup spans Free, Pro ($10/month), Pro+ ($39/month), and a new Max tier ($100/month). Each paid plan now includes two credit buckets: base credits matched 1:1 to the subscription price, and a variable flex allotment on top — giving Pro users $15 total, Pro+ users $70, and Max users $200 in monthly included usage. Code completions and next-edit suggestions remain unlimited on all paid plans and do not consume credits. The flex allotment is designed to adjust over time as AI model pricing and efficiency evolve, while base credits are fixed. Existing Pro and Pro+ subscribers on monthly billing are migrated automatically on June 1 with no action required.
Vercel AI Gateway Production Index: How Real Teams Actually Use AI Models
Vercel's AI Gateway, serving tens of trillions of tokens across 200K+ teams, reveals a stark divide between spend and volume in production AI workloads. In April 2026, Anthropic captured 61% of spend — driven by Claude Opus on quality-critical calls — while Google led on token volume at 38%, powered by cheap Gemini Flash for high-frequency tasks. Agentic workloads now account for 58.9% of all tokens (up from 31.6% in October 2025), yet only 22.2% of requests, because tool-call chains are roughly 2.6x more token-heavy than chat. High-scale teams averaging 10M+ requests use 35 distinct models on average, routing across a purpose-built fleet rather than relying on any single provider. Fallback rescues 3.5% of requests and 4.9% of spend, with the most expensive calls — long-context windows and multi-step agent runs — failing at disproportionately higher rates. The data signals that multi-model routing is now standard production architecture, not an advanced optimization.
5 Years and $5M Later: Inventing a New Programming Language for Web Dev Was a Mistake
Wasp co-founder Matija Sosic reflects on why building a custom DSL compiler in Haskell for a full-stack JavaScript framework was ultimately the wrong call after five years and $5M raised through Y Combinator. The language, designed to abstract common web-app patterns like auth, routing, and cron jobs into a high-level specification on top of React and Node.js, resonated with developers in principle but created persistent barriers: the wasp-lang name implied replacing JavaScript, Haskell branding confused positioning, and maintaining a language server and VS Code extension for a custom language proved far harder than anticipated. Crucially, the team discovered that Wasp's real moat was never the syntax — it was the compile-time, full-app-level understanding that makes both human reasoning and AI-assisted development more reliable. They are now replacing the custom language with a TypeScript SDK, preserving the same Wasp compiler internals while eliminating the adoption friction, with a TypeScript-first Launch Week imminent.
The dominant story of the week was the Mini Shai-Hulud supply-chain attack — a coordinated campaign by the TeamPCP threat group that used an automated malware platform to compromise over 169 npm package names (373 malicious versions) and several PyPI packages on May 11. Namespaces hit include @tanstack (83 entries), @squawk (87), @uipath (66), @mistralai, @tallyui, @beproduct, and the Guardrails AI PyPI package. The payload exploited pull_request_target GitHub Actions workflows to extract OIDC tokens without ever stealing maintainer passwords, injected a 2.3 MB obfuscated router_init.js payload carrying valid SLSA Build Level 3 provenance attestations, and installed OS-level persistence via launchd or systemd. A destructive dead-man's switch runs rm -rf on the developer's home directory if a stolen GitHub token is revoked. SafeDep detected the compromise within six minutes; Aikido Security within hours.
A separate but serious vulnerability, CVE-2026-42897, was disclosed affecting Microsoft Exchange Server 2016, 2019, and Subscription Edition via a cross-site scripting zero-day in Outlook Web Access already being actively exploited in the wild. Exchange Online is unaffected. Microsoft published automatic mitigation through the Exchange Emergency Mitigation Service (verify Mitigation M2 is active); air-gapped servers must run the Exchange on-premises Mitigation Tool manually. No formal patch release date has been announced.
On the AI tooling and industry front, GitHub Copilot restructured its individual plans starting June 1 with Free, Pro ($10), Pro+ ($39), and a new Max tier ($100), moving to usage-based billing with flex allotments on top of fixed base credits. Vercel's AI Gateway production data across 200K+ teams revealed that Anthropic captured 61% of spend (led by Claude Opus) while Google led on token volume (38%, led by Gemini Flash), with agentic workloads now accounting for 58.9% of all tokens. Wasp co-founder Matija Sosic published a candid postmortem admitting their Haskell DSL was a mistake and announcing a migration to a TypeScript SDK.
Key Takeaways
Mini Shai-Hulud is a new class of npm worm: it produces malicious packages carrying valid SLSA Build Level 3 provenance, installs a dead-man's switch that runs rm -rf on token revocation, and achieved self-spreading across 169 package names in hours — lockfile pinning and minimum package age policies in pnpm are the most actionable immediate mitigations.
CVE-2026-42897 is an actively exploited Exchange Server XSS zero-day affecting OWA on Exchange 2016, 2019, and SE — verify that Mitigation M2 is active via the Exchange Emergency Mitigation Service now; no formal patch date has been given.
Vercel AI Gateway data from 200K+ teams shows multi-model routing is now standard production architecture: high-scale teams use 35 models on average, Anthropic leads on spend (61% via Claude Opus), Google leads on volume (38% via Gemini Flash), and agentic workloads now drive 58.9% of all tokens.
