Mini Shai-Hulud Worm Targets TanStack, Mistral AI, and Others in Major Supply Chain Attack
In May 2026, the threat actor TeamPCP launched a sophisticated supply chain attack known as the Mini Shai-Hulud campaign, compromising over 170 npm and PyPI packages, including those from TanStack, Mistral AI, UiPath, OpenSearch, and Guardrails AI. The attackers injected obfuscated JavaScript files into these packages, which, upon execution, profiled the environment and deployed credential-stealing malware targeting cloud providers, cryptocurrency wallets, AI tools, messaging apps, and CI systems. The stolen data was exfiltrated to attacker-controlled domains, and the malware established persistence in development environments by integrating with IDEs like Visual Studio Code. This incident underscores the escalating threat of supply chain attacks, particularly those targeting widely used open-source packages. The use of self-propagating malware that exploits developer environments highlights the need for enhanced security measures in software development pipelines. Organizations must remain vigilant, regularly audit their dependencies, and implement robust monitoring to detect and mitigate such sophisticated attacks.
Kill Chain
