A single PR just hijacked the NPM registry...
Credibility score: 86/100 — Highly Credible. This video is highly credible with well-supported claims.
BSmeter analyzed "A single PR just hijacked the NPM registry..." and rated it 86/100 for credibility (a BS score of 14/100 — highly credible), on 2026-05-14. Its weakest claim — "Mini Shai-Hulud virus struck again in sophisticated Tanstack attack on May 14, 2026" — scored 50/100 and was flagged as just vibes. 8 claims were checked against the video transcript. Scores are produced by BSmeter's AI analysis of the transcript, not independent human verification.
Claims analyzed
100+ NPM packages compromised in 6 mins via PR, 50M downloads/week, no phishing/tokens stolen, via trusted publishing — Solid (85/100)
👌✅
Mini Shai-Hulud virus struck again in sophisticated Tanstack attack on May 14, 2026 — Just Vibes (50/100)
Rodent poop cruise virus vs Mini Shai-Hulud — wild intro 😂
Fork PR poisoned GitHub Actions shared cache — Verified (95/100)
✅
Unrelated PR triggered poison, hit 84 TanStack packages — Verified (92/100)
👌
Victims: Mistral AI, UiPath, OpenSearch, Guardrails AI, Squawk — Solid (88/100)
✅
Aikido tracked 373 poisoned versions in 169 packages — Verified (96/100)
💯
Sentry sponsor: Shipped Seer Agent for AI issue investigation — Sponsored (50/100)
Sponsor read: Sentry Seer Agent beta 🚀
Malware checks tokens every 60s, wipes root if expired — Verified (94/100)
😤✅
See the full analysis with sources and timestamps →