Shai Hulud attack ships signed malicious TanStack, Mistral npm packages
…Once an infection occurs, the malware writes itself into Claude Code hooks and VS Code auto-run tasks, so uninstalling the malicious packages does not remove it. The self-propagation mechanism remains…
