Case mini-shai-hulud-ai-packagesAI supply chainWorldwide
Mini Shai-Hulud worm hits TanStack, Mistral AI and Guardrails AI packages
TeamPCP's worm hijacked release pipelines to publish 170+ malicious npm/PyPI versions, stealing cloud, CI and AI-tool credentials and planting persistence in Claude Code and VS Code.
CriticalAttack on AIStatus: ContainedVerified case file
Open in the interactive mapCite this case
- Reported
- May 12, 2026
- Location
- Worldwide
- Target
- npm/PyPI AI developer packages
- Severity
- Critical
- Triggered by
- TeamPCP
- Actor type
- Criminal
- Reported loss
- None reported
- CVE
- None
What happened
TeamPCP's worm hijacked release pipelines to publish 170+ malicious npm/PyPI versions, stealing cloud, CI and AI-tool credentials and planting persistence in Claude Code and VS Code.
Impact: 170+ malicious versions across 19 npm namespaces plus PyPI, including packages with 1.3M weekly downloads; stole GitHub, AWS, Vault, Kubernetes, npm and AI-tool credentials and planted persistence hooks in Claude Code and VS Code
Who triggered it
Actor: TeamPCP
Attribution: Attributed to TeamPCP by Wiz, Socket, Expel and Phoenix Security based on tooling overlap with earlier campaigns
Motive: Mass credential theft (cloud, CI, npm, AI-tool tokens) for resale and further compromise
How it happened
Attack vector: Fork pull request against TanStack router poisoned the GitHub Actions cache, extracted an OIDC publish token and published trojanized packages; worm then reused stolen npm tokens to spread
Root cause: GitHub Actions cache collision between fork and upstream PRs, overly broad token permissions and build-plus-publish in one job, defeating 2FA and trusted publishing
Timeline
- Attacker fork of TanStack/router created; orphaned commit plants malicious workflow
- Malicious TanStack, OpenSearch, Mistral AI and Guardrails AI versions published to npm and PyPI
- Socket, Wiz and Expel publish analyses; maintainers yank versions and rotate tokens
- Related fork-triggered compromise hits openapi-react-query-codegen
Response
Compromised versions removed; TanStack published a post-mortem; vendors issued IOCs and cleanup guidance for IDE persistence hooks; affected users told to rotate all secrets
Current status: Contained
Sources (open in a new tab)
- Tom's Hardware tomshardware.com
- Expel expel.com
- Phoenix Security phoenix.security
- Endor Labs endorlabs.com
Cite this case
Mini Shai-Hulud worm hits TanStack, Mistral AI and Guardrails AI packages. AI Threat Watch, case mini-shai-hulud-ai-packages, May 12, 2026. https://aithreat.io/cases/mini-shai-hulud-ai-packages/
Permanent link: https://aithreat.io/cases/mini-shai-hulud-ai-packages/