The Mini Shai-Hulud campaign shows how dangerous modern software supply-chain attacks have become when CI/CD, package registries, provenance, and developer tools are all abused together. The campaign reportedly compromised npm and PyPI packages linked to TanStack, Mistral AI, OpenSearch, Guardrails AI, UiPath, and others, using obfuscated JavaScript and Python payloads to steal credentials from cloud services, crypto wallets, AI tools, messaging apps, GitHub Actions, and CI systems.

What makes this especially concerning is that some malicious packages were published through legitimate GitHub Actions release workflows and even carried valid SLSA provenance attestations. That means defenders can no longer treat “signed” or “properly built” as automatically safe when the build pipeline itself has been hijacked. The report says the worm can locate publishable npm tokens, enumerate maintainer packages, abuse GitHub OIDC tokens, and spread to other packages, because apparently package managers needed their own biological horror franchise. 

Organizations should immediately review affected package versions, rotate GitHub, npm, PyPI, cloud, CI/CD, and developer secrets, inspect GitHub Actions workflows for malicious changes, and monitor for exfiltration to suspicious domains such as filev2.getsession[.]org and api.masscan[.]cloud. For developers, the lesson is brutal but simple: open-source dependencies are executable trust relationships, not harmless downloads with friendly README files.

TeamPCP, the threat actor behind the recent supply chain attack spree, has been linked to the compromise of the npm and PyPI packages from TanStack, UiPath, Mistral AI, OpenSearch, and Guardrails AI as part of a fresh Mini Shai-Hulud campaign. The affected npm packages have been modified to include an obfuscated JavaScript file ("router_init.js") that's designed to profile the execution

Source: Mini Shai-Hulud Worm Compromises TanStack, Mistral AI, Guardrails AI & More Packages via The Hacker News — published 12 May 2026.