Mini Shai-Hulud Supply Chain Attack Compromises TanStack and Mistral AI Packages
On May 11, 2026, the threat group TeamPCP executed the "Mini Shai-Hulud" supply chain attack, compromising 84 npm and PyPI packages from TanStack, Mistral AI, and UiPath. By hijacking GitHub Actions pipelines via cache poisoning and OIDC token extraction, attackers published malicious versions with valid SLSA provenance. The worm-like malware steals cloud credentials and cryptocurrency keys, featuring geofenced destructive code targeting Israel and Iran. This incident marks the first case of malicious packages carrying verified cryptographic attestations, necessitating immediate secret rotation for affected developers globally.
Editorial summary awaiting refresh
Cross-source coverage
Wire timeline
Hackers Threaten to Leak Stolen Mistral AI Files After Confirming Breach
The hacking group TeamPCP has stolen approximately 450 repositories from AI company Mistral AI and is attempting to sell the data on the dark web for around $25,000. The group has issued an ultimatum stating that if no buyer is found within a week, they will leak the files publicly for free. The stolen data reportedly includes about 5GB of internal source code related to training, fine-tuning, and model delivery. The breach was executed via a supply chain attack named 'Mini Shai-Hulud,' which targeted the TanStack npm package by injecting infostealer malware to harvest developer credentials and keys. Mistral AI confirmed that its codebase management system was compromised and that some SDK packages were briefly contaminated. However, the company emphasized that its core systems, hosted services, managed user data, and research environments remain unaffected. This incident highlights ongoing security risks in the software supply chain, particularly affecting open-source dependencies widely used in development ecosystems.
Latest from TechRadarTanStack Supply Chain Attack Compromises Two OpenAI Employee Devices, Forces macOS Updates
OpenAI has disclosed that two employee devices were compromised in a supply chain attack targeting TanStack, known as Mini Shai-Hulud. The company confirmed that while unauthorized access and credential exfiltration occurred in limited internal source code repositories, no user data, production systems, or intellectual property were affected. In response, OpenAI isolated impacted systems, rotated credentials, and revoked code-signing certificates for iOS, macOS, and Windows products. Consequently, macOS users of ChatGPT Desktop and related apps must update to the latest versions to avoid potential risks from fake applications. This marks the second certificate rotation for OpenAI's macOS apps in recent months, following a previous incident involving a North Korean hacking group. The attack is part of a broader campaign by the threat actor TeamPCP, which also impacted Mistral AI and other organizations by compromising open-source packages. TeamPCP has reportedly threatened to leak stolen source code from Mistral AI. The incident highlights the growing risk of attacks on shared software dependencies and development tooling within the interconnected open-source ecosystem.
The Hacker NewsOpenAI Compromised in TanStack npm Supply Chain Attack
OpenAI has confirmed that it was affected by the recent TanStack npm supply chain compromise, part of the broader "Mini Shai-Hulud" cybercampaign. Attackers successfully delivered malware hidden within poisoned npm packages to two employee devices, which had not yet received updated security protections during a phased rollout. This breach allowed the attackers to exfiltrate a limited amount of internal credential material from accessible code repositories. Although OpenAI stated there is no evidence that customer data, production systems, or deployed software were compromised, the incident necessitated precautionary measures. The company is currently rotating signing certificates for several desktop applications, including ChatGPT Desktop, Codex App, Codex CLI, and Atlas. Users are required to update these applications by June 12 to ensure security. The attack is linked to the threat group TeamPCP, which has been targeting developer infrastructure and npm ecosystems to steal credentials such as GitHub tokens and CI/CD authentication materials. OpenAI continues to investigate the incident and monitor for any potential downstream abuse of the stolen credentials.
www.theregister.com - ArticlesOpenAI Urges macOS Updates Following TanStack Supply Chain Attack
OpenAI has mandated that macOS users update their applications by June 12 following a supply chain attack that compromised the company’s software signing certificates. The incident is linked to a broader campaign targeting the popular open-source library TanStack, which affected numerous npm and PyPI packages associated with several AI firms. OpenAI confirmed that two employee devices were breached, leading to limited credential exfiltration from internal source code repositories, but asserted that no customer data was stolen. While Windows and iOS users are unaffected, macOS users must install the update to ensure software legitimacy and continued support. The attack also impacted Mistral AI, with hackers known as TeamPCP allegedly attempting to sell stolen source code. Security experts note the malware included credential stealers and self-propagating capabilities, indicating a sophisticated operation. OpenAI has isolated affected systems, rotated credentials, and coordinated with platforms to block unauthorized notarizations. The incident highlights significant risks in software supply chains, where compromised packages can distribute malware to millions of developers and end-users globally.
The Record from Recorded Future NewsMicrosoft Investigates Mistral AI PyPI Package Compromise in Mini Shai-Hulud Supply Chain Attack
Microsoft has announced an investigation into the compromise of the Mistral AI PyPI package version 2.4.6, identifying it as a likely component of the broader Mini Shai-Hulud supply chain attack. This sophisticated campaign has simultaneously targeted the npm ecosystem, affecting popular web developer tools from TanStack, such as react-router, as well as packages associated with UiPath. Security researchers report that the malware exhibits specific behavioral traits, including refusing to execute on systems configured with Russian language settings, while potentially delivering destructive payloads under certain geographic conditions. The attack vector appears to involve cache poisoning and the distribution of signed malicious packages, raising concerns about exposed GitHub, cloud, and CI/CD credentials. Immediate triage recommendations for developers include verifying the integrity of dependency trees by running sha256sum checks on critical files like router_init.js. The incident highlights significant vulnerabilities within open-source software ecosystems, particularly those serving AI and web development communities. Multiple cybersecurity firms, including Socket, Endor Labs, and Wiz, have corroborated the scale of the breach, urging users to audit their dependencies urgently to mitigate potential data exfiltration and system compromise risks associated with this widespread infection.
TechmemeAnalysis of the Sophisticated TanStack npm Supply Chain Attack
On May 11, 2026, the JavaScript ecosystem faced a severe supply chain attack targeting 42 TanStack packages. Attackers published 84 malicious versions within six minutes, exploiting a complex vulnerability chain rather than stealing credentials. The exploit utilized a GitHub Actions workflow configured with pull_request_target, allowing code from a forked pull request to run in the base repository context. This enabled cache poisoning, where a malicious 1.1 GB cache entry was injected. When a legitimate maintainer later triggered a release, the poisoned cache executed malware that minted an OIDC token for trusted publishing on npm. The resulting malware acts as a worm, harvesting AWS, GitHub, and SSH credentials while exfiltrating data via encrypted channels. It self-propagates by republishing infected versions of any package maintained by the compromised user. Developers who installed affected packages during the incident window are urged to assume system compromise and immediately rotate all secrets. The article recommends defensive measures such as using isolated development environments, employing proper secrets managers, and configuring package managers to disable post-install scripts or enforce minimum package age policies to prevent similar future attacks.
DEV CommunityCache-Poisoning Attack Compromises TanStack npm Packages with Malicious Code
A sophisticated supply chain attack targeted official TanStack npm packages, resulting in the publication of 84 malicious versions within a six-minute window on May 11, 2026. The attacker exploited a GitHub Actions cache poisoning vulnerability by submitting a malicious pull request from a forked repository, which triggered automated build scripts to inject malware. This incident is part of the broader 'Mini Shai-Hulud' campaign affecting multiple ecosystems, including PyPI. The malicious payload was designed to steal credentials, such as cloud keys and crypto wallets, by scanning over 100 hardcoded file paths. Additionally, it featured a self-propagation mechanism and a 'dead-man's switch' that wipes the infected host's disk if stolen GitHub tokens are revoked. Security firm StepSecurity detected the breach within 30 minutes, leading to immediate deprecation of the packages by npm and a security advisory from GitHub. Experts warn that any developer or CI environment installing affected versions during the attack window is considered compromised, urging immediate rotation of all secrets. The attack highlights ongoing vulnerabilities in major package repositories and the risks associated with automated build processes.
www.theregister.com - ArticlesMini Shai-Hulud Worm Compromises TanStack, Mistral AI, and Guardrails AI Packages
The threat actor TeamPCP has launched a new supply chain attack campaign dubbed Mini Shai-Hulud, compromising npm and PyPI packages from major organizations including TanStack, UiPath, Mistral AI, OpenSearch, and Guardrails AI. The attack involves injecting obfuscated JavaScript into npm packages to profile execution environments and steal credentials from cloud providers, cryptocurrency wallets, and CI systems like GitHub Actions. Data is exfiltrated via the Session Protocol domain or attacker-controlled GitHub repositories. A critical aspect of this campaign is its worm-like propagation; it hijacks GitHub Actions workflows and uses stolen OIDC tokens to publish malicious versions with valid SLSA provenance, bypassing traditional authentication. The TanStack compromise, assigned CVE-2026-45321 with a CVSS score of 9.6, impacted 42 packages. Additionally, the malicious Mistral AI PyPI package includes geofenced destructive code targeting users in Israel and Iran. This incident marks the first documented npm worm producing validly attested malicious packages, highlighting severe risks in software supply chains across AI, frontend, and enterprise automation ecosystems.
The Hacker NewsMajor npm Packages Compromised in Mini Shai-Hulud Supply Chain Attack
A significant supply chain attack, identified as the 'Mini Shai-Hulud' incident, has compromised numerous npm packages associated with prominent technology frameworks and companies. According to security firm Socket, affected libraries include tools for Mistral, UiPath, and TanStack’s web development utilities, such as react-router. This breach poses a severe risk to developers and organizations relying on these dependencies, potentially allowing malicious code injection into widespread applications. Socket advises immediate triage measures, specifically recommending that developers run 'shasum -a 256' on all router_init.js files within their dependency trees to detect compromises. The incident highlights ongoing vulnerabilities in open-source software ecosystems and the critical nature of supply chain security. As a major event in the cybersecurity landscape, it underscores the need for rigorous verification processes in package management. The attack impacts a broad spectrum of the tech industry, from AI model providers like Mistral to enterprise automation platforms like UiPath, demonstrating the far-reaching consequences of compromised foundational software components.
TechmemeTanStack Npm Packages Compromised in Mini Shai-Hulud Supply Chain Attack
On May 11, 2026, the threat group TeamPCP executed a sophisticated supply chain attack known as Mini Shai-Hulud, compromising 84 npm package artifacts across 42 @tanstack/* packages. Unlike previous attacks relying on stolen credentials, this incident hijacked TanStack’s legitimate GitHub Actions release pipeline mid-workflow. The attackers utilized a Pwn Request, cache poisoning, and OIDC token extraction from runner memory to publish malicious versions signed with valid SLSA Build Level 3 attestations. This marks the first documented case of malicious npm packages carrying verified cryptographic provenance, making them indistinguishable from legitimate builds. The worm rapidly spread to other ecosystems, including Mistral AI and UiPath. Security firm StepSecurity attributed the attack to TeamPCP, also known as DeadCatx3, which has previously targeted Aqua Security and Bitwarden. Experts warn that any environment installing affected versions during the window is compromised and requires immediate secret rotation. The incident highlights critical vulnerabilities in CI/CD pipelines and the limitations of current software supply chain security standards like SLSA when the build process itself is subverted.
Blog RSS Feed | Snyk