TeamPCP's Mini Shai-Hulud campaign has compromised over 170 packages across npm and PyPI, affecting 518 million downloads. The worm steals credentials and can turn into a wiper malware if detected.
TL;DR
- TeamPCP's Mini Shai-Hulud worm has infected 170+ packages, with 518 million cumulative downloads.
- The worm steals credentials and can trigger a destructive routine if npm tokens are revoked.
- The attack leverages hijacked GitHub OIDC tokens and includes valid SLSA Build Level 3 provenance attestations.
What happened
TeamPCP, the threat actor behind recent supply chain attacks, has launched a new campaign called Mini Shai-Hulud. This campaign has compromised packages from TanStack, Mistral AI, Guardrails AI, and others across npm and PyPI registries. The affected packages have been modified to include an obfuscated JavaScript file designed to steal credentials and exfiltrate data to attacker-controlled domains.
The worm uses hijacked GitHub OIDC tokens to spread, leveraging the Session Protocol infrastructure to evade detection. It can also establish persistence hooks in Claude Code and Microsoft Visual Studio Code, and monitor GitHub tokens to re-exfiltrate them. The attack has been linked to the compromise of 42 packages and 84 versions across the TanStack ecosystem, with a CVSS score of 9.6.
The TanStack supply chain compromise was traced to a chained GitHub Actions attack involving the 'pull_request_target' trigger, GitHub Actions cache poisoning, and runtime memory extraction of an OIDC token. The attack published malicious versions through the project's own GitHub Actions release pipeline using hijacked OIDC tokens, making this the first documented npm worm that produces validly attested malicious packages.
Why it matters
This attack is significant because it abuses trusted publishing, allowing attacker-controlled code to leverage OIDC permissions to publish packages without stealing npm tokens. The worm's ability to spread itself to other packages by locating publishable npm tokens with bypass_2fa set to true is a notable escalation in supply chain attacks.
Developers and organizations using the affected packages should immediately isolate and image their systems without revoking npm tokens, as the worm includes a dead-man's switch that can trigger a destructive routine if the token is revoked. This reflects a broader shift in supply chain attacks from isolated package compromise to identity-driven propagation through trusted CI/CD infrastructure.
The impact of this campaign is far-reaching, with over 170 packages affected and 518 million cumulative downloads. The affected packages span various ecosystems, including search infrastructure, AI tooling, aviation-related developer packages, enterprise automation, frontend tooling, and CI/CD-adjacent ecosystems.
Key facts
- The Mini Shai-Hulud campaign has compromised over 170 packages across npm and PyPI registries.
- The affected packages have over 518 million cumulative downloads.
- The worm steals credentials and exfiltrates data to attacker-controlled domains, including 'filev2.getsession[.]org' and 'api.masscan[.]cloud'.
- The attack leverages hijacked GitHub OIDC tokens and includes valid SLSA Build Level 3 provenance attestations.
- The TanStack supply chain compromise has been assigned the CVE identifier CVE-2026-45321 with a CVSS score of 9.6.
- The worm can establish persistence hooks in Claude Code and Microsoft Visual Studio Code, and monitor GitHub tokens to re-exfiltrate them.
- The attack includes a dead-man's switch that can trigger a destructive routine if the npm token is revoked.
- The campaign has affected packages from TanStack, Mistral AI, Guardrails AI, UiPath, OpenSearch, and others.
Context
Supply chain attacks have become increasingly sophisticated, with threat actors leveraging trusted publishing and CI/CD infrastructure to spread malware. The Mini Shai-Hulud campaign is a notable example of this trend, as it abuses GitHub OIDC tokens and includes valid SLSA provenance attestations to evade detection.
The use of a dead-man's switch in this campaign highlights the growing aggressiveness of threat actors. This tactic is designed to deter developers from revoking compromised npm tokens, as doing so could trigger a destructive routine that wipes the infected machine.
The impact of this campaign is far-reaching, with over 170 packages affected and 518 million cumulative downloads. The affected packages span various ecosystems, including AI tooling, enterprise automation, and CI/CD-adjacent ecosystems. Developers and organizations using these packages should take immediate action to isolate and image their systems without revoking npm tokens.