Recently, a rare large-scale “supply chain attack” targeting the open source ecosystem officially broke out. The “Mini Shai-Hulud” worm attack, which was initially thought to only affect the TanStack npm package, expanded rapidly in just a few days and has now evolved into a comprehensive campaign spanning the two major package ecosystems, npm and PyPI, involving more than 170 packages. Affected companies include well-known technology companies such as OpenAI, Mistral AI, UiPath, and AWS OpenSearch.
From TanStack to Full Proliferation: A Timeline of Attacks
May 11, 19:20 UTC, security researchersDiscover 42 npm packages from the @tanstack/* family were compromised, involving a total of 84 malicious versions. The attacker exploited the setting vulnerability of GitHub Actions to embed malicious code into the legitimate release process, successfully bypassing the review mechanism of TanStack maintainers.
But this is only the beginning. SecurityWeek works with multiple security companiesTracking display, The attack spread rapidly, extending from TanStack to suites of multiple organizations such as OpenSearch (AWS’s open source search engine), Mistral AI (French AI unicorn), Guardrails AI, UiPath, and Squawk. Aikido.dev Statistics display, so far, more than 169 npm packages and at least 2 PyPI packages have been hacked, and the total number of malicious versions has exceeded 400.
Even more worryingly, as of this writing, the attacks are still ongoing. The Semgrep security team reported a few hours ago that the TanStack Router suite was once again attacked by an updated version of Mini Shai-Hulud. This time, an encrypted credential leak mechanism and Dead Man’s Switch were added, showing that the attackers were not completely blocked, but were continuing to iterate their weapons.
Attack method: sophisticated combination of three vulnerability chains
Details released by TanStack officials afterwardsaccident report, the attacker’s complete intrusion path is restored. The attacker did not exploit a single vulnerability, but cleverly connected three known weaknesses into an attack chain (CVE-2026-45321):
- Phase 1: Pwn Request — Attackers exploited the TanStack repository
pull_request_targetDefects in workflow settings. This GitHub Actions feature allows PRs from forks to access warehouse secrets. Attackers include malicious code in PRs, triggering this classic attack mode called “Pwn Request.” - Phase Two: GitHub Actions Cache Poisoning — During the execution of the malicious PR, a modified pnpm store (up to 1.1 GB in size) was written to the GitHub Actions shared cache. This cache key is identical to the key used by the legitimate publishing workflow.
- The third stage: OIDC Token theft — A subsequent merge request that was perfectly legitimate triggered the release workflow. Since the cache has been poisoned, the publishing process loads the malicious pnpm store. The attacker’s code is executed in the CI environment, stealing the GitHub OIDC token, and using this token to sign a malicious version of the package and publish it to the npm registry.
The same CI/CD setting vulnerability was exploited in the Trivy attack in March, showing that such vulnerabilities are still common in the open source ecosystem.
Deep implantation of AI development tools
The most threatening feature of this attack is the malware’s deep hook mechanism for AI developer tools. Security research indicates that Mini Shai-Hulud is not just a traditional credential stealer, but a persistent threat specifically designed to inhabit the ecosystem of AI-encoded agents.
After the infected package is installed, the malicious code does the following:
- Hook Claude Code:Revise
.claude/settings.json, causing the malicious code to re-execute every time Claude Code triggers a tool event - Hook VS Code:Revise
.vscode/tasks.json, establish an automatically executed work schedule - Stealth execution: Use Bun runtime instead of Node.js execution to bypass Node-based security detection tools
- Dead Man’s Switch: Built-in a trigger mechanism – when the victim revokes the stolen GitHub token, the malicious program will automatically delete the user’s home directory
The most noteworthy thing is thatpure execution npm uninstall This threat cannot be removed. Since the malware’s hook has been written into the configuration files of Claude Code and VS Code, even if the infected package is removed, the hook still exists and will try to be re-executed every time the development tool is started. For complete removal, users must manually check and delete these IDE hook settings.
OpenAI was also caught: two employee devices were compromised
On May 14, OpenAI issued an official response confirming that it was affected by the TanStack supply chain attack. OpenAI express, an investigation revealed that the devices of two employees in the internal environment had been compromised. OpenAI emphasized that there is currently no evidence that user data has been accessed or leaked.
A few days ago, OpenAI urgently required all macOS users to update their applications because an attack caused the destruction of some program signing keys. The scope of impact includes OpenAI’s macOS desktop application, and OpenAI has proactively contacted affected users and provided repair instructions.
It’s not just npm: PyPI is also affected
SafeDep’s security research shows that attackers have reached out to the Python ecosystem. In this campaign, at least two PyPI packages were also implanted with the same malicious code. This means teams that rely on Python for AI/ML development are also at risk.
In addition, Mend.io’s analysis pointed out that this is not the first time Mini Shai-Hulud has appeared. The attacker TeamPCP has launched at least five waves of attacks since the beginning of 2026 and has previously targeted the SAP developer suite for intrusion.
How to respond: Mitigation measures and detection tools
In response to this wave of attacks, the security community has quickly proposed a number of response plans. TanStack has officially marked all affected versions as deprecated, and the npm security team has also stepped in to remove the malicious tarball. TanStack also released subsequent strengthening measures, including re-examining CI/CD workflow security.
For developers and system administrators, the following measures are recommended:
- Scan now: Use community-made detection tools (such as shayr1/shai-hulud-scan) to check whether there are signs of infection in the local environment
- Check IDE Hooks: Manual check
.claude/settings.jsonand.vscode/tasks.jsonIs there any abnormal content? - Revoke and rotate Token: If the GitHub token may have been used in an infected environment, immediately revoke and regenerate it
- Update dependencies: Make sure the TanStack series suite has been updated to the latest unaffected version
- pnpm user: pnpm v10.16 has introduced delayed dependency updates as a layer of defense against supply chain attacks
Conclusion
The Mini Shai-Hulud supply chain attack is one of the most serious open source ecosystem security incidents so far in 2026. It not only shows how attackers can cleverly connect multiple known vulnerabilities into sophisticated attack chains, but also reveals a new attack surface in the AI development tool ecosystem – when there is deep integration between your development tools, AI coding agents, and package management systems, attackers have the opportunity to establish persistence mechanisms that go beyond traditional cleanup methods.
This incident also sent a strong signal to all developers: simply updating the package version is no longer enough to prevent supply chain attacks. Reviewing the security of CI/CD workflows and regularly scanning IDE and AI tool configuration files are changing from “best practices” to “necessary measures.”
Source: KOCPC Chinese