TeamPCP's Mini Shai-Hulud Worm Compromises TanStack npm Packages

May 11, 2026 · Original article ↗

Summary

StepSecurity analyzes Mini Shai-Hulud's npm supply-chain campaign, detailing runner-memory credential theft, self-propagation and malicious releases with valid provenance. TanStack confirmed 84 malicious versions across 42 packages.

Key points

TanStack's post-mortem confirmed 84 malicious versions across 42 packages, linking the compromise to a pull_request_target attack, GitHub Actions cache poisoning and OIDC token extraction.
StepSecurity attributes the campaign to TeamPCP and reports expansion beyond TanStack to UiPath, DraftLab and other maintainers.
A malicious optional Git dependency executes a Bun-based payload during installation. Runtime telemetry captured token harvesting and Python reading GitHub Actions Runner.Worker process memory.
The worm searches for publishing credentials, enumerates packages controlled by compromised maintainers and uses OIDC token exchange to publish additional infected releases.
Malicious packages carried valid provenance tied to the legitimate release pipeline, illustrating that provenance establishes build origin rather than artifact safety.
Deobfuscation revealed broad credential harvesting, Claude Code and VS Code persistence hooks, OS-level token-monitoring services and injected workflows for secret collection.
Encrypted stolen data is sent through the Session Protocol CDN and GitHub GraphQL commits disguised with Dependabot-style branches. The article recommends auditing dependencies and persistence, isolating affected machines and rotating exposed credentials.

Article Details

Attack Vectors: Malicious npm releases execute an obfuscated worm through an injected optional Git dependency and its prepare lifecycle hook.
TanStack's post-mortem describes a chain involving pull_request_target abuse, GitHub Actions cache poisoning, and OIDC token extraction from runner memory.
Stolen maintainer credentials and per-package OIDC token exchanges enable autonomous publication of infected packages across additional maintainers' portfolios.
Compromised release pipelines produce malicious packages with valid SLSA provenance attestations.
Injected GitHub Actions workflows serialize repository secrets for direct exfiltration or publication as workflow artifacts.
Developer-tool startup hooks and operating-system services repeatedly execute the malware and monitor GitHub tokens.
Defensive Notes: Treat secrets accessible to environments that installed compromised versions as exposed, including masked GitHub Actions secrets.
The source warns that token revocation can trigger a destructive routine; isolate and image affected machines before revoking the threatening npm tokens.
Check lockfiles against affected releases and inspect installed packages for router_init.js, the injected @tanstack/setup dependency, and unexpected Bun execution.
Restore clean dependency versions, reinstall dependencies, and remove malicious Claude Code hooks, VS Code tasks, LaunchAgents, systemd services, and injected workflows.
Rotate exposed npm tokens, GitHub tokens, cloud credentials, SSH keys, and other accessible secrets after containment.
Audit packages published by affected pipelines for downstream infection and review unexpected publish events, dead-drop commits, and outbound connections.
Valid SLSA provenance establishes pipeline origin but does not establish that the pipeline or resulting package was safe.
Use restrictive CI network egress policies and package-release cooldowns to reduce exfiltration and exposure to newly published malicious releases.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`git-tanstack[.]com`	C2 domain contacted by bun.exe during the observed malicious package installation.
EMAIL	`voicproducoes@gmail[.]com`	Email listed by the source under attacker infrastructure associated with the payload-staging GitHub account.
SHA256	`2ec78d556d696e208927cc503d48e4b5eb56b31abc2870c2ed2e98d6be27fc96`	Hash of tanstack_runner.js staged in the malicious Git commit.
SHA256	`7c12d8614c624c70d6dd6fc2ee289332474abaa38f70ebe2cdef064923ca3a9b`	Hash of the malicious @tanstack/setup package.json containing the payload execution hook.
SHA256	`ab4fcadaec49c03278063dd269ea5eef82d24f2124a8e15d7b90f2fa8601266c`	Hash of router_init.js, the malicious payload embedded in compromised @tanstack packages.
URL	`hxxps[:]//api[.]masscan[.]cloud/v2/upload`	Explicit exfiltration endpoint used by the injected workflow to POST serialized repository secrets.