Mini Shai-Hulud npm worm: detect, rotate, and shrink your blast radius

TanStack, Mistral AI, and UiPath npm packages got hit on May 11, 2026. A 60-second detection script, a rotation-first checklist, and the single-purpose APIs that replace four of the most-poisoned package types.