Mini Shai-Hulud Worm Compromises TanStack, Mistral AI, Guardrails AI and Dozens of Other Packages

A sophisticated supply chain attack campaign known as Mini Shai-Hulud has compromised more than 170 packages across npm and PyPI. High-profile affected projects include TanStack (especially @tanstack/react-router), Mistral AI’s official SDKs, Guardrails AI, UiPath, OpenSearch, and many others. The combined download count of the impacted packages exceeds 500 million.

The threat actor, tracked as TeamPCP, used a multi-stage approach. They first gained control of legitimate maintainer CI/CD pipelines, primarily through GitHub Actions. From there, they published malicious versions of packages while generating valid SLSA Build Level 3 provenance attestations. The worm then spread to other packages maintained by the same accounts or organizations.

The payload is aggressive. It steals credentials from cloud providers, GitHub tokens, AI tool integrations, and cryptocurrency wallets. It exfiltrates data through privacy-focused channels and includes a dead-man’s switch — a destructive mechanism that can wipe a developer’s home directory if the attacker’s publishing token is revoked.

This incident goes beyond typical package hijacking. It demonstrates how attackers can maintain the appearance of legitimacy while delivering harmful behavior at scale. For enterprises building agentic AI systems that depend on these open source components, the implications are direct and serious. (238 words)

Key Terms

• Mini Shai-Hulud Worm: A self-propagating malware campaign that compromises maintainer pipelines and spreads to other packages under the same ownership.

• SLSA Attestations: Cryptographic records designed to verify how and by whom a package was built. The attackers produced valid Level 3 attestations for malicious code.

• OIDC Token Abuse: Exploitation of OpenID Connect tokens in GitHub Actions to obtain short-lived publishing credentials without stealing long-term secrets.

• GitHub Actions Cache Poisoning: A technique that injects malicious code into shared build caches so it executes in legitimate workflows.

• Behavioral Integrity: The assurance that a software package performs only the functions described in its documentation and continues to do so over time.

• Dead Man’s Switch: A malicious feature that triggers destructive commands (such as deleting user files) if the attacker loses control of the publishing token.

These terms reflect the evolution of supply chain threats from simple replacements to sophisticated pipeline compromises that preserve outward legitimacy. (204 words)

Conditions Driving This Change

Several structural factors have made campaigns like Mini Shai-Hulud increasingly successful:

• The rapid expansion of agentic AI has driven heavy reliance on open source packages for tool calling, guardrails, orchestration frameworks, vector operations, and model integrations. Developers add these dependencies quickly.

• CI/CD pipelines, especially GitHub Actions, sit at the center of package publishing but frequently use broad permission scopes that make token abuse easier.

• Many projects configure OIDC trust at the repository level rather than restricting it to specific workflows or files, creating exploitable gaps.

• The sheer volume of packages published daily makes thorough manual review impractical for most maintainers and consuming organizations.

• Automated dependency management tools and build systems place significant trust in maintainer reputation and provenance records once a package clears initial checks.

• Previous supply chain successes have encouraged threat actors to refine their methods, moving from isolated compromises to self-propagating worms.

• Agentic systems that dynamically discover and invoke tools from registries amplify the impact of any compromised dependency because agents often act on tool metadata with limited human oversight.

• Security tooling and organizational processes still focus primarily on pre-publication scanning and static checks rather than continuous behavioral monitoring after installation.

These conditions create an environment where attackers can compromise legitimate pipelines, maintain the appearance of trust, and scale their impact across thousands of downstream users.

What It Looked Like Before

Prior to this campaign, the dominant approach to supply chain security relied on a combination of code signing, SBOM generation, SLSA provenance attestations, vulnerability scanning, and maintainer reputation.

Organizations typically scanned new dependencies for known malware and vulnerabilities at the point of addition. Once a package passed those checks and entered the dependency tree, attention shifted elsewhere. Many teams assumed that valid SLSA records and trusted maintainer accounts provided reasonable assurance of safety. In practice, monitoring of installed packages was limited. Teams focused on version updates and known CVEs but had limited visibility into whether a package’s actual runtime behavior matched its documented purpose over time.

This model worked against basic attacks such as simple maintainer account takeovers or typo-squatting. It struggled, however, against adversaries who could compromise the build pipeline itself and produce packages that appeared fully legitimate according to all standard checks. Most governance programs treated supply chain risk as a static inventory and pre-deployment problem rather than an ongoing operational concern. This left a gap between what the documentation and provenance records claimed and what the code actually did once installed and executed.

What It Looks Like Now

The Mini Shai-Hulud campaign has altered the reality on the ground. Attackers compromised legitimate CI/CD pipelines, injected malicious code, and published new versions that carried valid SLSA attestations. The worm then propagated to other packages under the same maintainer accounts.

Security researchers from Socket, Aikido, StepSecurity, Wiz, and others have documented how the malware steals a wide range of credentials and establishes persistence in development environments. Some versions include aggressive fallback mechanisms that can destroy local files if remediation is attempted. The incident demonstrates that valid provenance and trusted maintainer status no longer provide sufficient protection. A package can clear every automated pre-publication check and still introduce harmful behavior after installation.

Organizations are now confronting the need for more continuous oversight. Some are implementing stricter scoping of CI/CD permissions, more frequent re-validation of critical dependencies, and runtime behavioral monitoring. Teams working with agentic systems are beginning to examine how tools and dependencies are discovered and invoked at runtime rather than trusting registry metadata alone. The campaign has also accelerated discussions around discovery binding — mechanisms that ensure the tool or package an agent actually calls matches the one it evaluated during selection.