Mini Shai-Hulud Supply-Chain Campaign Compromises TanStack and Other npm, PyPI Packages

May 11, 2026 · Original article ↗

Summary

Socket reports malicious npm and PyPI package releases linked to Mini Shai-Hulud. The malware targets CI, cloud, and developer credentials, can propagate through package publishing, and prompted TanStack to remove affected versions and harden workflows.

Key points

Socket identified malicious code in 84 TanStack npm package artifacts; the article's later campaign update lists 1,069 affected packages across npm and PyPI.
The malware uses obfuscated payloads and package lifecycle hooks to execute during installation, targeting GitHub Actions and developer systems.
Credential targets include GitHub and npm tokens, AWS credentials and metadata services, Vault secrets, and Kubernetes service-account tokens.
The payload can use GitHub Actions OIDC publishing access to republish infected packages and can add persistence through Claude Code and VS Code configuration.
TanStack said the attack exploited a pull_request_target workflow and GitHub Actions cache poisoning to access its trusted-publisher workflow; it reported no stolen npm tokens.
TanStack deprecated affected versions, worked with npm to remove malicious tarballs, purged Actions caches, and hardened its workflows.
The article recommends rotating exposed secrets, reviewing developer environments and publishing logs, verifying package integrity, and restricting GitHub Actions OIDC permissions.

Article Details

Attack Vectors: Compromised npm packages distribute router_init.js directly and introduce a Git-based @tanstack/setup dependency whose prepare lifecycle hook executes tanstack_runner.js during installation.
TanStack's postmortem attributes initial compromise to chained pull_request_target abuse, GitHub Actions cache poisoning across the fork-to-base trust boundary, and extraction of an OIDC token from runner process memory.
According to TanStack, attacker-controlled code executed during workflow test/cleanup and published malicious packages directly through the project's OIDC trusted-publisher binding; npm tokens were not stolen and the publishing workflow itself was not compromised.
The implant harvests CI environment credentials, accesses cloud metadata and secrets APIs, and propagates by modifying and republishing package archives under compromised maintainer identities.
Stolen GitHub tokens enable repository modification through createCommitOnBranch, including malicious workflow definitions and developer-tool configuration files.
Developer workstation persistence uses Claude Code hooks and VS Code workspace tasks to re-execute copied payloads after the original package is removed.
Socket confirmed that guardrails-ai@0.10.1 executes malicious code on import on Linux, downloading a Python archive to /tmp/transformers.pyz and executing it with python3 without integrity verification.
Harvested credentials are exfiltrated through Session file-server and service-node infrastructure.
Defensive Notes: Hash router_init.js files throughout dependency trees and compare them with the published malware hashes.
Rotate secrets on systems that installed affected versions, prioritizing npm tokens, GitHub PATs and OIDC trusts, AWS credentials, Vault tokens, and Kubernetes service account tokens.
Revoke affected GitHub Actions OIDC federation grants and restore them only after validating workflow integrity.
Audit developer home and project .claude/ and .vscode/ directories for router_runtime.js, setup.mjs, unfamiliar hooks, and unexpected workspace tasks; package removal alone does not remove this persistence.
Review commits attributed to the spoofed Claude Code bot identity and unexpected package publishes from CI runners.
The article recommends blocking Session-related egress when that service is not required, favoring DNS-level controls because its service-node network is distributed.
Enforce pinned package integrity values and block CI on lockfile hash mismatches.
Disable OIDC permissions in workflows that do not require them and restrict id-token: write to the publishing job.
Do not treat valid Sigstore provenance alone as proof that a package is safe; attacker-executed CI code can produce valid attestations.
TanStack deprecated affected versions, engaged npm security to remove malicious tarballs, purged Actions caches, and hardened workflows with repository-owner guards and pinned third-party action references.
Socket reported that guardrails-ai@0.10.0 and earlier did not contain the newly introduced malicious code.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`git-tanstack[.]com`	Attacker infrastructure serving the Python payload and displaying a credential-theft claim signed TeamPCP.
EMAIL	`claude@users[.]noreply[.]github[.]com`	Spoofed commit-author identity used by the implant when injecting malicious files into maintainer repositories; not evidence that the legitimate bot account is compromised.
MD5	`833fd59ebe66a4449982c6d18db656b4`	Published hash of the router_init.js / router_runtime.js malicious payload.
MD5	`b82e54923f7e440664d2d75bd31588ca`	Published hash of the tanstack_runner.js / router_init.js malicious variant.
SHA1	`12ed9a3c1f73617aefdb740480695c04405d7b4b`	Published hash of the router_init.js / router_runtime.js malicious payload.
SHA1	`79ac49eedf774dd4b0cfa308722bc463cfe5885c`	Suspicious GitHub commit containing @tanstack/setup and the tanstack_runner.js payload with an automatic prepare execution hook.
SHA1	`e69bf4b3e84e7951a7b4ded8fee8822c57630cf8`	Commit identifier for an intercom/intercom-php artifact listed in the compromised-package table.
SHA1	`e7d582b98ca80690883175470e96f703ef6dc497`	Published hash of the tanstack_runner.js / router_init.js malicious variant.
SHA256	`2ec78d556d696e208927cc503d48e4b5eb56b31abc2870c2ed2e98d6be27fc96`	Published hash of the tanstack_runner.js / router_init.js malicious variant.
SHA256	`ab4fcadaec49c03278063dd269ea5eef82d24f2124a8e15d7b90f2fa8601266c`	Published hash of the router_init.js / router_runtime.js malicious payload.
URL	`hxxp[:]//filev2[.]getsession[.]org/file/`	Defanged Session file-server URL listed in the IOC section for the implant's credential exfiltration.
URL	`hxxps[:]//git-tanstack[.]com/transformers[.]pyz`	Remote malicious Python archive downloaded and executed by compromised guardrails-ai@0.10.1.