Mini Shai-Hulud Campaign Injected Credential-Stealing Malware Into Open-Source Packages
Summary
The Mini Shai-Hulud campaign reportedly compromised hundreds of packages through manipulated GitHub Actions pipelines, targeting developer and cloud credentials. TanStack says affected versions were removed; researchers reported limited community spread and no evidence
Key points
- The campaign reportedly injected credential-stealing malware into hundreds of open-source packages, including packages from TanStack, UiPath, and MistralAI.
- Attackers reportedly used an orphaned commit and overly broad GitHub Actions permissions to trigger malicious automated releases that passed provenance checks.
- The malware targeted cloud and developer secrets, including AWS, Google Cloud, Kubernetes, Vault, and local SSH keys.
- The malware reportedly propagated by publishing copies to projects and disguising commits as activity from the Anthropic Claude bot.
- It reportedly added persistence in Visual Studio Code and Claude Code configuration directories and used Session to exfiltrate stolen data.
- Researchers attributed the campaign to TeamPCP; one researcher said community spread had been very limited.
- TanStack said compromised versions were removed. The article says there was no evidence registry passwords were stolen and recommends rotating connected credentials.
Article Details
- Attack Vectors
- Attackers used an orphaned commit pushed to a repository fork to trigger automated releases through GitHub Actions workflows with overly broad permissions.
- Compromised package updates carried valid provenance signatures because the CI pipelines that produced them had been manipulated.
- A concealed dependency fetched an obfuscated payload disguised as an initialization module.
- The malware propagated by publishing copies of itself to affected projects and spoofing automated commits as activity from the Anthropic Claude bot.
- Defensive Notes
- Remove compromised package versions from registries and identify whether they were installed in CI/CD or developer environments.
- Rotate cloud, server, and developer credentials that may have been exposed, including credentials for AWS, Google Cloud, and GitHub; check local secret files and SSH keys.
- Review unexpected outbound connections, package lockfile changes, unusual package publishes from maintainers or CI systems, and persistence artifacts in developer tooling directories.
- Audit .claude/ and .vscode/ configurations, hooks, and tasks rather than treating them as benign local files.
- Review CI workflows and permissions, since valid provenance signatures did not establish that the underlying pipeline was safe.
MITRE ATT&CK
T1059.007 · JavaScriptThe malware used Bun to run JavaScript while stealing credentials and publishing copies of itself.T1105 · Ingress Tool TransferA concealed dependency fetched an obfuscated 2.3-megabyte payload disguised as an initialization module.T1195.001 · Compromise Software Dependencies and Development ToolsCredential-stealing code was injected into trusted open-source packages, including packages associated with TanStack, UiPath, and MistralAI.T1195.002 · Compromise Software Supply ChainThe campaign manipulated CI pipelines and GitHub Actions workflows to publish malicious package updates with valid provenance signatures.T1552.001 · Credentials In FilesThe malware searched developers’ local computers for secret files and targeted cloud and developer credentials.T1552.004 · Private KeysThe malware searched developers’ local computers for SSH keys.
People
Charlie EriksenA security researcher at Aikido Security who commented on the campaign’s limited community spread and enterprise impact.Feross AboukhadijehSocket CEO who recommended checking for compromised package installations, suspicious outbound connections, lockfile changes, unusual package publishes, and persistence artifacts.Stephen ThoemmesA senior developer advocate at Snyk who described developer-tool configuration directories as an attack surface and recommended auditing them.
Threat Actors
Malware
ChainDropA rapidly spreading campaign dubbed “mini Shai-Hulud” compromised hundreds of open-source packages, including TanStack, UiPath, and MistralAI, by injecting credential-stealing code into trusted development tools.Shai HuludThe group, alleged to be responsible for earlier development of Shai Hulud, quietly slips their malware into trusted software updates, allowing them to infect thousands of companies at once without triggering security
Vendors
Products
AWSThe attack bypassed two-factor authentication and valid provenance checks by abusing GitHub Actions and automated publishing pipelines, exposing AWS, Google Cloud, GitHub, Kubernetes, and Vault credentials at risk.BunUpon execution, the malware uses Bun — a high-speed software engine designed to run JavaScript — to systematically steal security keys and passwords.Claude CodeResearchers linked the operation to TeamPCP and warned of persistence in VS Code and Claude Code directories.GitHubThe attack bypassed two-factor authentication and valid provenance checks by abusing GitHub Actions and automated publishing pipelines, exposing AWS, Google Cloud, GitHub, Kubernetes, and Vault credentials at risk.GitHub ActionsThe attack bypassed two-factor authentication and valid provenance checks by abusing GitHub Actions and automated publishing pipelines, exposing AWS, Google Cloud, GitHub, Kubernetes, and Vault credentials at risk.Google CloudThe attack bypassed two-factor authentication and valid provenance checks by abusing GitHub Actions and automated publishing pipelines, exposing AWS, Google Cloud, GitHub, Kubernetes, and Vault credentials at risk.Google Cloud PlatformIt targets high-level cloud infrastructure, including AWS, Google Cloud Platform, Kubernetes, and HashiCorp Vault.HashiCorp VaultIt targets high-level cloud infrastructure, including AWS, Google Cloud Platform, Kubernetes, and HashiCorp Vault.KubernetesThe attack bypassed two-factor authentication and valid provenance checks by abusing GitHub Actions and automated publishing pipelines, exposing AWS, Google Cloud, GitHub, Kubernetes, and Vault credentials at risk.MistralAIA rapidly spreading campaign dubbed “mini Shai-Hulud” compromised hundreds of open-source packages, including TanStack, UiPath, and MistralAI, by injecting credential-stealing code into trusted development tools.React RouterTanStack’s React Router package alone accounts for more than 12 million weekly downloads, placing the malicious code deep within the software supply chain of modern enterprise applications.SessionThis ensures the malicious scripts execute automatically every time a developer opens a project or initiates an AI coding session.TanStackA rapidly spreading campaign dubbed “mini Shai-Hulud” compromised hundreds of open-source packages, including TanStack, UiPath, and MistralAI, by injecting credential-stealing code into trusted development tools.UiPathA rapidly spreading campaign dubbed “mini Shai-Hulud” compromised hundreds of open-source packages, including TanStack, UiPath, and MistralAI, by injecting credential-stealing code into trusted development tools.VSCodeTo maintain continuous access to developer workstations, the malware embeds itself into the configuration files of popular developer tools, notably Visual Studio Code and Anthropic’s Claude Code.