Mini Shai-Hulud Worm Hits TanStack, Mistral AI and UiPath, Compromising 170+ npm and PyPI Packages With 518M Combined Downloads

Overview

A new wave of the Shai-Hulud npm worm hit the JavaScript and Python ecosystems on May 11, 2026, compromising more than 170 packages across npm and PyPI in a five-hour window. The attack, dubbed Mini Shai-Hulud and tracked by multiple security vendors, used a chain of GitHub Actions misconfigurations to publish 84 malicious TanStack versions through the project’s own release pipeline before spreading to packages from UiPath, Mistral AI, OpenSearch and Guardrails AI. The Hacker News reports the compromised packages have more than 518 million cumulative downloads, and attribution has been linked to TeamPCP, the same crew behind a string of recent supply-chain intrusions including the Checkmarx Jenkins AST plugin backdoor earlier this month.

What We Know

Timeline and scope

SecurityWeek and CSO Online place the attack on May 11, 2026, with Snyk narrowing the initial TanStack burst to between 19:20 and 19:26 UTC. Within roughly five hours, the attackers had pushed more than 400 malicious package versions to npm, according to SafeDep, which counted 404 malicious versions spanning 170 npm packages plus two PyPI packages.

Vendor counts of the affected universe vary by methodology. SafeDep recorded 404 versions across 170 npm names and two on PyPI; Aikido Security tracked 373 entries across 169 namespaces, as cited by CSO Online. The Hacker News summary settles on “over 170 packages” and “more than 518 million downloads cumulatively” across both registries.

TanStack as the entry point

The TanStack Router ecosystem was the first cluster to fall. Snyk reports that 84 malicious artifacts were published across 42 @tanstack packages, with two malicious versions appearing for each of @tanstack/react-router (1.169.5 and 1.169.8), @tanstack/vue-router, @tanstack/solid-router, @tanstack/router-core, @tanstack/react-start (1.167.68 and 1.167.71), and @tanstack/router-plugin (1.167.38 and 1.167.41). Sibling families including @tanstack/query, @tanstack/table, @tanstack/form, @tanstack/virtual and @tanstack/store were unaffected.

From TanStack the worm spread outward. SecurityWeek lists 65 UiPath npm packages, the OpenSearch JavaScript client, Mistral AI’s PyPI SDK, the Guardrails AI PyPI package, and several Squawk and DraftLab modules among the affected. SafeDep notes that the rogue mistralai 2.4.6 PyPI release has no matching tag in the project’s official repository — the legitimate latest version was 2.4.5, published May 7.

The attack chain

Snyk’s post-mortem walks through a three-stage exploit against TanStack’s release infrastructure. The attacker first created a fork named zblgg/configuration and opened PR #7378, titled “WIP: simplify history build,” which fired a workflow gated only on the dangerous pull_request_target trigger. Wiz describes how that workflow then poisoned the GitHub Actions cache with a malicious pnpm store; Snyk recorded the poisoned cache at 1.1 GB and noted it persisted undetected for roughly eight hours. The final stage extracted OIDC tokens from the runner’s process memory by reading /proc//maps and /proc//mem, following a documented tj-actions technique, and then used those tokens to publish signed releases through TanStack’s legitimate npm trusted-publishing pipeline.

SecurityWeek summarises the chain as “a pull_request_target ‘Pwn Request’ misconfiguration, GitHub Actions cache poisoning across the fork↔base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process.” Because the eventual publish step used valid OIDC credentials from TanStack’s own infrastructure, the malicious releases shipped with SLSA Build Level 3 provenance attestations, which The Hacker News describes as “the first documented npm worm that produces validly attested malicious packages.”

What the malware does

The injected payload arrives as router_init.js, a 2.3 MB obfuscated JavaScript file hidden in the package tarball outside the declared files field, per Snyk. Snyk decoded three obfuscation layers — a JavaScript Obfuscator wrapper, a Fisher-Yates substitution cipher using PBKDF2-SHA256 with 200,000 iterations, and 11 AES-256-GCM encrypted payloads that require the Bun runtime to execute. The malware’s internal campaign label is EveryBoiWeBuildIsAWormyBoi.

Once executing, the payload sweeps the host for credentials. SafeDep enumerates “dedicated providers for AWS IAM, HashiCorp Vault, GitHub tokens (ghp_, gho_, ghs_), npm publish tokens, and GitHub Actions OIDC tokens.” Snyk adds that the worm also reads ~/.npmrc, SSH keys, and ~/.claude/projects/*.jsonl session histories from Claude Code, and installs persistence hooks via .claude/router_runtime.js and .vscode/setup.mjs so any subsequent IDE session re-runs the payload.

Wiz documented a destructive component: a daemon called gh-token-monitor that polls the GitHub API every 60 seconds and runs rm -rf ~/ on the host if the attacker’s exfiltration token is revoked. The dead-man’s-switch token, as noted by The Hacker News, carried the description “IfYouRevokeThisTokenItWillWipeTheComputerOfTheOwner.” Wiz catalogued three exfiltration channels: the Session messenger network endpoint filev2.getsession[.]org, GitHub GraphQL dead-drops posted as claude@users.noreply.github.com, and a typosquat domain at git-tanstack[.]com.

Attribution and detection

Wiz assessed “with high confidence that this is the work of TeamPCP,” linking the campaign to earlier intrusions affecting SAP, Checkmarx, Bitwarden, Lightning, Intercom and Trivy. SafeDep observed that the PyPI payload included a message signed “With Love TeamPCP,” reinforcing the attribution. StepSecurity researcher Ashish Kurmi told The Hacker News that “the worm has since spread beyond TanStack to packages from UiPath, DraftLab, and other maintainers.”

Detection was rapid but not preventive. BankInfoSecurity reports that StepSecurity flagged the malicious TanStack uploads roughly 20 minutes after they appeared, but SafeDep tallied 401 malicious npm versions published before the window closed. Endor Labs framed the lesson bluntly, telling the same outlet that the attack “succeeded against a target that did everything right on paper,” referring to TanStack’s use of two-factor authentication and trusted-publisher binding.

What We Don’t Know

The exact number of downstream victims who pulled the rogue versions before npm and PyPI removed them is not yet public. None of the cited outlets quantify how many CI pipelines fetched the malicious TanStack, UiPath or Mistral releases during the window they were live, nor how many of those pipelines ran the install-time hooks against systems with credentials in scope. The status of credential rotation across the affected maintainer organisations has also not been publicly summarised.

Attribution beyond the TeamPCP signature remains an open question. The Wiz and SafeDep posts link the campaign by tradecraft and signed message to TeamPCP’s earlier work; none of the cited sources tie the actor to a state or named criminal affiliate, and the motive ladder — credential theft, downstream propagation, opportunistic destruction via the wipe daemon — does not, on the evidence so far, distinguish between financially motivated extortion infrastructure and a more targeted goal.

Analysis

The Mini Shai-Hulud wave is technically novel for one reason: it is the first npm worm to ship malicious packages with valid SLSA Build Level 3 provenance attestations, per The Hacker News. That matters because attestation has been one of the few defences pitched as a hard barrier between maintainer accounts and the registry. TanStack had configured trusted publishing and two-factor authentication; the attacker did not bypass those controls but rather rode them, because the publish step that signed the release ran inside TanStack’s own CI environment with a token TanStack itself had authorised npm to trust. From npm’s perspective, the upload looked exactly like every other release the project has shipped.

The technique that made this possible — combining a pull_request_target trigger with cache poisoning and process-memory OIDC theft — has been documented for over a year. Snyk’s write-up attributes the OIDC-from-memory pattern to the tj-actions incident and notes the three primitives in isolation are well known. What the TeamPCP wave demonstrated is that any one open-source project that combines them in a release workflow becomes a viable distribution point for malware to dozens of downstream packages, regardless of how seriously its maintainers take account hygiene. The control surface is no longer the maintainer’s npm token; it is every CI workflow they have ever merged.