The Mini Shai-Hulud worm has caused a new crisis in software supply chain security, infecting dozens of popular packages in the npm and PyPI repositories. The team behind this attack, TeamPCP , has targeted packages from leading companies such as TanStack , Mistral AI , UiPath , OpenSearch , and Guardrails AI .
See also: 'Mini Shai-Hulud': SAP-Related npm Packages Compromised with Credential Stealer
The malware has infected a total of 169 npm packages with 373 versions, as well as several PyPI packages. The infected npm packages contain an obfuscated JavaScript file named “router_init.js”, which is designed to analyze the execution environment and launch a full-fledged credential stealer. This stealer targets cloud providers, cryptocurrency wallets, AI tools, messaging applications and CI systems, including GitHub Actions, Aikido Security, Endor Labs, SafeDep, Socket and StepSecurity.
Data extraction is done via the domain “filev2.getsession[.]org“, a strategic choice aimed at avoiding detection. The attackers use the infrastructure of the Session Protocol, a decentralized messaging service focused on privacy, making blocking the domain unlikely in corporate environments. As an alternative, the encrypted data is stored in repositories controlled by the attackers with the author name “claude@users.noreply.github.com” via the GitHub GraphQL API.
The Mini Shai-Hulud worm has advanced capabilities that make it particularly dangerous. The malware can install persistence hooks in Claude Code and Microsoft Visual Studio Code, allowing it to survive reboots and re-run every time the IDEs are opened. In addition, it installs a gh-token-monitor service to monitor and re-export GitHub tokens and injects two malicious GitHub Actions workflows that convert repository secrets into JSON objects and upload them to an external server (“api.masscan[.]cloud”).
See also: Shai-Hulud-type worm hits CI pipelines and AI tools
TanStack has identified that the breach resulted from a GitHub Actions chain attack that included the “pull_request_target” trigger, cache poisoning, and runtime memory extraction of an OIDC token from the GitHub Actions runner process. According to the company, no npm tokens were stolen and the npm publish workflow itself was not compromised.
The attackers placed the malicious payload on a GitHub fork, integrated it into published npm tarballs, and then hijacked the legitimate “TanStack/router” workflow to publish the compromised builds with a valid SLSA provenance. What makes the worm stand out is its ability to spread to other packages by detecting publishable npm tokens with bypass_2fa set to true, enumerating each package published by the same maintainer, and exchanging a GitHub OIDC token for a per-package publish token.
The TanStack supply chain breach has been assigned the identifier CVE-2026-45321 with a CVSS score of 9.6 out of a maximum of 10.0 , indicating critical severity. The incident has affected 42 packages and 84 versions across the TanStack ecosystem.
In addition to TanStack, the Mini Shai-Hulud campaign has spread to several other packages, including some on PyPI: guardrails-ai@0.10.1, mistralai@2.4.6, @opensearch-project/opensearch in multiple versions, @squawk/weather@0.5.10, @squawk/flightplan@0.5.6, and various @tallyui packages.
Microsoft , in its analysis of the malicious mistralai PyPI package , stated that it is designed to download a credential stealer from a remote server (“83.142.209[.]194”) that includes country-aware logic to avoid Russian environments.
Security researchers from StepSecurity point out that this is the first documented case of an npm worm producing validly attested malicious packages with SLSA Build Level 3 provenance attestations. This makes detection extremely difficult, as the packages appear legitimate to automated security tools.
See also: New version of Shai-Hulud worm spreads via npm, GitHub
To protect against such attacks, organizations should implement immediate measures such as pinning to secure package releases, revoking and regenerating all CI/CD secrets, and using supply chain monitoring tools such as Socket.dev and Aikido. Implementing behavioral monitoring to detect memory scraping and propagation patterns is also critical to preventing future attacks of similar scale.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
