Mini Shai-Hulud Weaponizes Tasks.JSON Files

Mini Shai-Hulud is an active npm worm (attributed to TeamPCP) that spreads by adding auto-executing developer tooling configs—most notably .vscode/tasks.json with "runOn":"folderOpen" and .claude SessionStart hooks—into repositories, enabling remote code execution, credential harvesting, and self-propagation across GitHub; four SAP CAP-related npm packages and multiple file-hash IOCs are identified, and immediate actions include hunting for the tasks.json/.claude signatures, rotating exposed credentials, pinning dependencies, and tightening OIDC and workspace-trust policies.