TeamPCP’s Mini Shai-Hulud Worm Spreads Through Compromised npm and PyPI Packages
Summary
Reports link TeamPCP’s Mini Shai-Hulud worm to compromised npm and PyPI packages. The malware steals credentials, abuses GitHub Actions and OIDC tokens, persists in developer IDEs, and propagates through package publishing.
Key points
- The campaign was linked to TeamPCP and affected packages associated with TanStack, UiPath, Mistral AI, OpenSearch, Guardrails AI, and other publishers.
- Compromised npm packages included an obfuscated router_init.js credential stealer targeting cloud services, wallets, AI tools, messaging apps, and CI systems.
- The stealer reportedly exfiltrated data to filev2.getsession[.]org; a fallback stored encrypted data in attacker-controlled repositories using stolen GitHub tokens.
- Malicious GitHub Actions workflows were designed to collect repository secrets and send them to api.masscan[.]cloud. The malware also added IDE persistence hooks and a GitHub-token monitoring service.
- TanStack attributed its compromise to a chain involving the pull_request_target trigger, GitHub Actions cache poisoning, and extraction of an OIDC token from a runner. TanStack said npm tokens were not stolen and its npm publish workflow was not compromised.
- The worm reportedly enumerated maintainers’ packages and used OIDC tokens to obtain per-package publish tokens. The article says 42 TanStack packages and 84 versions were affected and identifies CVE-2026-45321.
- Microsoft’s analysis said the compromised mistralai package downloaded a credential stealer with geofenced destructive behavior; Socket reported that [email protected] executed downloaded code on import.
Article Details
- Attack Vectors
- Compromised npm and PyPI packages delivered credential-stealing malware, including an obfuscated JavaScript file named router_init.js.
- The attackers abused a pull_request_target workflow trigger, GitHub Actions cache poisoning, and runtime extraction of an OIDC token from a runner to publish compromised TanStack packages.
- The worm used publishable npm tokens and GitHub OIDC tokens to spread to packages published by other maintainers.
- Malicious GitHub Actions workflows serialized repository secrets and uploaded them to an external server.
- The compromised [email protected] package downloaded and executed a remote Python artifact without integrity verification.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | api[.]masscan[.]cloud | External server used by malicious GitHub Actions workflows to upload serialized repository secrets. |
| DOMAIN | filev2[.]getsession[.]org | Attacker-controlled domain to which the malware exfiltrated stolen data. |
| IPV4 | 83[.]142[.]209[.]194 | Remote server from which the malicious mistralai PyPI package downloaded a credential stealer. |
| URL | hxxps[:]//git-tanstack[.]com/transformers.pyz | Specific URL identified as hosting the malicious Python artifact downloaded and executed by the compromised guardrails-ai package. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe npm package payload included an obfuscated JavaScript file.T1059.006 · PythonThe compromised guardrails-ai package executed a downloaded Python artifact using python3.T1059.007 · JavaScriptThe compromised npm packages included an obfuscated JavaScript credential stealer in router_init.js.T1105 · Ingress Tool TransferThe compromised mistralai package downloaded a credential stealer from a remote server, and guardrails-ai downloaded a remote Python artifact.T1195.001 · Compromise Software Dependencies and Development ToolsThe campaign spread through compromised npm and PyPI packages, including malicious versions published across multiple ecosystems.T1195.002 · Compromise Software Supply ChainThe attackers hijacked TanStack's GitHub Actions release workflow to publish compromised packages with valid SLSA provenance.T1550.001 · Application Access TokenThe attackers extracted an OIDC token from a GitHub Actions runner and used hijacked GitHub tokens through the GraphQL API.T1565.001 · Stored Data ManipulationThe article reports GitHub Actions cache poisoning as part of the chained attack against TanStack.T1567.002 · Exfiltration to Cloud StorageAs a fallback exfiltration method, the malware committed encrypted data to attacker-controlled GitHub repositories.
CVE
People
Threat Actors
Malware
Vendors
GitHubTeamPCP’s Mini Shai-Hulud campaign has compromised npm and PyPI packages from TanStack, UiPath, Mistral AI, OpenSearch, and Guardrails AI with credential-stealing malware and malicious GitHub Actions workflows.Guardrails AITeamPCP’s Mini Shai-Hulud campaign has compromised npm and PyPI packages from TanStack, UiPath, Mistral AI, OpenSearch, and Guardrails AI with credential-stealing malware and malicious GitHub Actions workflows.Mistral AITeamPCP’s Mini Shai-Hulud campaign has compromised npm and PyPI packages from TanStack, UiPath, Mistral AI, OpenSearch, and Guardrails AI with credential-stealing malware and malicious GitHub Actions workflows.OpenSearchTeamPCP’s Mini Shai-Hulud campaign has compromised npm and PyPI packages from TanStack, UiPath, Mistral AI, OpenSearch, and Guardrails AI with credential-stealing malware and malicious GitHub Actions workflows.TanStackTeamPCP’s Mini Shai-Hulud campaign has compromised npm and PyPI packages from TanStack, UiPath, Mistral AI, OpenSearch, and Guardrails AI with credential-stealing malware and malicious GitHub Actions workflows.UiPathTeamPCP’s Mini Shai-Hulud campaign has compromised npm and PyPI packages from TanStack, UiPath, Mistral AI, OpenSearch, and Guardrails AI with credential-stealing malware and malicious GitHub Actions workflows.
Products
Claude CodeThe malware is also capable of establishing persistence hooks in Claude Code and Microsoft Visual Studio Code (VS Code) to survive reboots and re-execute the stealer on every launch of the IDEs.GitHub ActionsTeamPCP’s Mini Shai-Hulud campaign has compromised npm and PyPI packages from TanStack, UiPath, Mistral AI, OpenSearch, and Guardrails AI with credential-stealing malware and malicious GitHub Actions workflows.npmTeamPCP’s Mini Shai-Hulud campaign has compromised npm and PyPI packages from TanStack, UiPath, Mistral AI, OpenSearch, and Guardrails AI with credential-stealing malware and malicious GitHub Actions workflows.PyPITeamPCP’s Mini Shai-Hulud campaign has compromised npm and PyPI packages from TanStack, UiPath, Mistral AI, OpenSearch, and Guardrails AI with credential-stealing malware and malicious GitHub Actions workflows.VSCodeThe malware is also capable of establishing persistence hooks in Claude Code and Microsoft Visual Studio Code (VS Code) to survive reboots and re-execute the stealer on every launch of the IDEs.
Countries
Industries
Aviationpropagate across both npm and PyPI, with affected packages spanning search infrastructure, AI tooling, aviation-related developer packages, enterprise automation, frontend tooling, and CI/CD-adjacent ecosystems.”Enterprise automationpackages spanning search infrastructure, AI tooling, aviation-related developer packages, enterprise automation, frontend tooling, and CI/CD-adjacent ecosystems.”Search infrastructurethe campaign continuing to propagate across both npm and PyPI, with affected packages spanning search infrastructure, AI tooling, aviation-related developer packages, enterprise automation, frontend tooling, and