Mini Shai-Hulud Worm Hits TanStack, Mistral AI and UiPath in Critical Supply Chain Attack

A sophisticated self-propagating worm has compromised more than 170 packages across the npm and PyPI registries, targeting widely used developer tools from TanStack, Mistral AI, UiPath, OpenSearch, and Guardrails AI. The campaign, dubbed Mini Shai-Hulud and attributed to threat actor group TeamPCP, was detected on 11 May 2026 and carries a CVSS score of 9.6, placing it in the critical severity band.

The affected npm packages were modified to include an obfuscated JavaScript file, "router_init.js", designed to profile the execution environment and launch a comprehensive credential stealer. Targeted systems include cloud providers, cryptocurrency wallets, AI tools, messaging applications, and CI systems including GitHub Actions. Stolen data is exfiltrated to attacker-controlled infrastructure via three redundant channels: a typosquat domain, the decentralised Session messenger network, and GitHub API dead drops using stolen tokens.

How the attack works

According to StepSecurity's analysis, the TanStack compromise was achieved by chaining three GitHub Actions vulnerabilities. The attacker created a fork of the TanStack/router repository, opened a pull request that triggered a "pull_request_target" workflow, and poisoned the GitHub Actions cache with a malicious pnpm store. When legitimate maintainer commits later triggered the release workflow, attacker-controlled binaries extracted OIDC tokens directly from the GitHub Actions runner process memory, enabling package publication without ever stealing an npm token.

What makes this campaign particularly dangerous is its worm behaviour. After gaining access to a victim's credentials, the malware enumerates every package published by the same maintainer, exchanges a GitHub OIDC token for a per-package publish token, and republishes poisoned versions autonomously. In doing so, it produces packages carrying valid SLSA Build Level 3 provenance attestations, making this the first documented npm worm to generate validly attested malicious packages, rendering standard provenance verification ineffective as a sole defence.

"The attack published malicious versions through the project's own GitHub Actions release pipeline using hijacked OIDC tokens. In an extremely rare escalation, the compromised packages carry valid SLSA Build Level 3 provenance attestations, making this the first documented npm worm that produces validly attested malicious packages." - Ashish Kurmi, researcher, StepSecurity

Persistence, destruction and a dead-man's switch

Beyond credential theft, the malware installs persistence hooks inside Claude Code and Microsoft Visual Studio Code to survive system reboots and re-execute the stealer on every IDE launch. It also installs a "gh-token-monitor" service that polls GitHub every 60 seconds to confirm its stolen token remains active. The token is given the description: "IfYouRevokeThisTokenItWillWipeTheComputerOfTheOwner."

The threat is not merely rhetorical. Should a developer revoke the npm token from their dashboard, the monitoring script triggers a destructive routine executing "rm -rf ~/" on the infected machine, effectively converting it into wiper malware. Security researchers are urging affected developers to isolate and image their systems before revoking any tokens.

"This campaign reflects a broader shift in supply chain attacks from isolated package compromise to identity-driven propagation through trusted CI/CD infrastructure. Once attackers gain access to publishing workflows and pipeline identities, the software delivery process itself becomes the distribution mechanism." - Avital Harel, security research lead, Upwind

Scale and affected packages

According to OX Security, the incident has affected over 170 packages across both registries. The packages carry more than 518 million cumulative downloads, with TanStack's react-router package alone accounting for approximately 12 million weekly downloads. No fewer than 400 repositories containing stolen credentials have been created as part of the attack wave, each bearing the string "Shai-Hulud: Here We Go Again." The PyPI packages from Mistral AI and Guardrails AI contain the same core malware but operate differently from the JavaScript versions, including country-aware logic designed to avoid Russian-language environments.

Microsoft's analysis of the malicious Mistral AI PyPI package revealed a geofenced destructive branch with a one-in-six probability of executing "rm -rf /" on systems appearing to be located in Israel or Iran. Wiz confirmed a third exfiltration channel via the typosquat domain "git-tanstack[.]com", in addition to the Session network and GitHub API dead drops.

What GCC enterprise teams must do now

For enterprise development teams across the Saudi market and the wider GCC region, where TanStack, Mistral AI tooling, and UiPath are widely deployed across fintech, government digital services, and enterprise automation, the exposure is material. Security teams should immediately audit lockfiles and CI logs for any affected package versions installed on or after 11 May 2026, check for the persistence daemon at the relevant system paths, and rotate all credentials from any affected machine or runner, including npm tokens, GitHub personal access tokens, cloud credentials, and CI/CD secrets. Critically, do not revoke tokens before isolating and imaging the affected system.

Teams should additionally block the domains "git-tanstack[.]com" and "*.getsession.org" and the IP "83.142.209[.]194" at DNS or proxy level. Snyk maintains an updated list of all compromised package versions and a remediation walkthrough for teams using Snyk in their dependency pipelines. Clean versions are available from maintainers published after 12 May 2026. TanStack has published a full postmortem on its website.

"The challenge for defenders is that much of this activity can appear legitimate on the surface, which makes behavioural visibility during installs and builds increasingly important." - Avital Harel, security research lead, Upwind

TeamPCP, also tracked under the aliases DeadCatx3, PCPcat, ShellForce, and CipherForce, has been linked to prior compromises of Aqua Security's Trivy scanner in March 2026 and the Bitwarden CLI npm package in April 2026. Unit 42 has documented the group's announced partnership with the Vect ransomware group. The Mini Shai-Hulud campaign marks a significant escalation in tradecraft, and security teams are advised to treat any environment that installed an affected package version on 11 May 2026 as fully compromised.