TeamPCP’s Mini Shai-Hulud Worm Spreads Across 170 npm Packages and PyPI

May 13, 2026 · Original article ↗

Summary

A self-propagating worm attributed to TeamPCP reportedly compromised 170 npm packages and two PyPI packages, stealing CI credentials through OIDC and spreading via republished releases. The article details affected versions, persistence, exfiltration, and response steps

Key points

The article reports 170 compromised npm packages across 19 namespaces and two PyPI packages, including OpenSearch and Mistral clients.
The campaign reportedly began with an orphaned commit in a TanStack repository that exposed a CI workflow’s npm publishing OIDC token, bypassing 2FA-protected publishing.
Compromised packages use preinstall hooks to download Bun, run an obfuscated payload, harvest CI and cloud credentials, and republish packages using OIDC federation.
The payload reportedly exfiltrates credentials through Session’s P2P messaging network and injects hooks and workflow files into downstream repositories.
The PyPI package guardrails-ai 0.10.1 reportedly downloads and executes a remote Python archive on import; mistralai 2.4.6 was also listed as compromised.
The article recommends moving off affected versions, rotating credentials exposed to infected CI runs, checking repositories for injected files, and disabling npm install scripts in CI.

Article Details

Attack Vectors: An attacker exploited an orphaned commit in a TanStack repository to access a CI workflow run holding an npm publishing OIDC token, bypassing 2FA-protected publishing.
Compromised npm packages execute through a preinstall hook, download Bun, and use it to launch a loader and an obfuscated credential-harvesting payload.
On CI runners with an active OIDC token, the worm mints npm publishing tokens through OIDC federation and republishes infected packages with Sigstore provenance attestations.
The implant harvests CI and cloud credentials, including GitHub Actions secrets, AWS and ECS metadata credentials, Kubernetes service-account tokens, and Vault tokens.
The implant exfiltrates credentials through Session messaging and its file endpoint; the PyPI package guardrails-ai 0.10.1 downloads and executes a remote Python archive on import on Linux.
The worm uses GitHub GraphQL to inject files and workflow definitions into downstream repositories, with commits attributed to claude@users.noreply.github.com.
Defensive Notes: Pin affected packages away from the compromised versions; for @opensearch-project/opensearch, the article recommends versions at or below 3.5.2 or a confirmed-clean newer release.
Rotate credentials that were accessible to CI runs that installed compromised packages, including GitHub Actions secrets, AWS keys, Kubernetes service-account tokens, and Vault tokens.
Search repositories for unexpected .claude and .vscode files, newly added workflow files, and commits attributed to claude@users.noreply.github.com.
Block the listed attacker infrastructure at egress and investigate affected hosts for /tmp/transformers.pyz and the described implant files.
Disable npm install scripts on CI runners with ignore-scripts where lifecycle hooks are not required.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`api[.]masscan[.]cloud`	Identified by the article as an attacker-controlled API.
DOMAIN	`git-tanstack[.]com`	Typosquat domain used to serve the PyPI dropper and a page claiming TeamPCP responsibility.
DOMAIN	`seed1[.]getsession[.]org`	Session bootstrap node listed as campaign infrastructure.
EMAIL	`claude@users[.]noreply[.]github[.]com`	Spoofed author address used on injected commits to disguise them as Claude Code agent output.
MD5	`833fd59ebe66a4449982c6d18db656b4`	Hash of router_init.js, the obfuscated npm implant.
MD5	`b82e54923f7e440664d2d75bd31588ca`	Hash of tanstack_runner.js, the worm-propagation loader.
SHA1	`12ed9a3c1f73617aefdb740480695c04405d7b4b`	Hash of router_init.js, the obfuscated npm implant.
SHA1	`e7d582b98ca80690883175470e96f703ef6dc497`	Hash of tanstack_runner.js, the worm-propagation loader.
SHA256	`2ec78d556d696e208927cc503d48e4b5eb56b31abc2870c2ed2e98d6be27fc96`	Hash of tanstack_runner.js, the worm-propagation loader.
SHA256	`ab4fcadaec49c03278063dd269ea5eef82d24f2124a8e15d7b90f2fa8601266c`	Hash of router_init.js, the obfuscated npm implant.
URL	`hxxp[:]//filev2[.]getsession[.]org/file/`	Primary npm-side credential exfiltration endpoint identified in the article.
URL	`hxxps[:]//git-tanstack[.]com/transformers[.]pyz`	PyPI dropper payload URL downloaded and executed by guardrails-ai 0.10.1 on import.