Mini Shai-Hulud Strikes Again: TanStack + more npm Packages Compromised

Detect and mitigate malicious npm packages linked to the latest Mini Shai-Hulud supply chain campaign targeting high-value developer tooling.

On 11 May 2026, TeamPCP launched a coordinated supply chain attack against the npm and PyPi ecosystems, compromising packages across multiple namespaces simultaneously.

May 13, 2026 2:30 UTC update:Further analysis of the@uipath/*and@mistralai/*npm packages has identified a bug in the payload that renders the malware non-functional in those cases.

Impacted packages include:

Packages in the@tanstacknamespace, which includes@tanstack/react-router, one of the most widely-used routing libraries in the React ecosystem with approximately 12 million weekly downloads.Postmortem

Packages in the@uipathnamespace, which provides tooling for UiPath's enterprise automation platform, including@uipath/apollo-core, CLI tools, and agent SDKs.Postmortem

The@mistralai/mistralaipackage, which is the official TypeScript client for the Mistral AI platform. ThemistralaiPyPi packages was also impacted.Postmortem

Theguardrails-aiLLM guardrails Python package.

SeeAffected Packagesfor detailed versions.

Thenpm team is aware of the campaign and has been acting quicklyto remove the malicious package versions from the registry.

May 12, 2026, 11AM UTC update: Added additional IOCs and updated the affected packages table.

The TanStack compromise exploited a chain of three vulnerabilities in GitHub Actions. The attacker created a fork of theTanStack/routerrepository (renamed tozblgg/configurationto evade fork-list searches), then opened a pull request that triggered apull_request_targetworkflow. This workflow checked out and executed the attacker's fork code, which poisoned the GitHub Actions cache with a malicious pnpm store.

When legitimate maintainer PRs were later merged tomain, the release workflow restored the poisoned cache. Attacker-controlled binaries thenextracted OIDC tokens directly from the GitHub Actions runner's process memory(/proc/<pid>/mem). The attacker was able to use these tokens to publish the malicious package versions without ever stealing npm credentials.

The published packages contain two infection vectors: anoptionalDependenciesentry pointing to an orphan commit (github:tanstack/router#79ac49eedf774dd4b0cfa308722bc463cfe5885c) that executes a payload via apreparescript, and an embedded ~2.3MB obfuscated filerouter_init.jsplaced directly in the package tarball.

Shortly after the@tanstackattack, packages in the@uipathnamespace were compromised. These packages use a preinstall script (node setup.mjs) that downloads the Bun runtime and executes the payload. This is the same delivery mechanism that was seen in the earlier SAP compromise. The UiPath variant uses a re-obfuscated version of the same payload witha different campaign key but identical C2 infrastructure.

When executed, the payload is a credential stealer and self-propagating worm. It targets CI/CD tokens (GitHub Actions OIDC, GitLab, CircleCI), cloud credentials (AWS IMDSv2, GCP, Azure), Kubernetes service accounts, HashiCorp Vault, and package registry tokens. It uses stolen npm tokens and GitHub Actions OIDC tokens to publish poisoned versions of additional packages the victim has write access to, functioning as a worm that spreads through the npm ecosystem.

The payload exfiltrates stolen credentials via three redundant channels: a typosquat domain (git-tanstack[.]com), the decentralized Session messenger network, and GitHub API dead drops using stolen tokens.

On developer machines, the malware installs a persistentgh-token-monitordaemon (via macOS LaunchAgent or Linux systemd) that polls GitHub every 60 seconds. On receiving a40Xerror due to token revocation,the monitor attempts to runrm -rf ~/.The daemon automatically exits after 24 hours without triggering the destructive handler.

As with previous Mini Shai-Hulud variants, the malware checks if the system is configured for the Russian language and terminates without exfiltrating data if so.

This operation delivers a payload that uses the same methods used in previous TeamPCP operations but contains several notable evolutions.

The payload exfiltrates stolen credentials via three redundant channels:

Typosquat domain:https://git-tanstack[.]com

Session messenger network: Decentralized, encrypted exfiltration via*.getsession.orgto recipient ID05f9e609d79eed391015e11380dee4b5c9ead0b6e2e7f0134e6e51767a87323026

GitHub API dead drops: Creates Dune-themed repositories using stolen tokens withShai-Hulud: Here We Go Againas the repo description.

The Session network channel is new. Decentralized and takedown-resistant, it issignificantly harder to disruptthan dedicated domains or GitHub-based exfiltration.

If the malware identifies anyghp_(GitHub Personal Access Tokens) orgho_(Oauth Tokens) it runs them through a series of checks:

It must be a valid token that contains a login field

It must include repo or public_repo in its scope

It must have a public profile

It must have the ability to write to a repo

It must be a member of an org

If these all pass the malware installs a persistentgh-token-monitordaemon that polls GitHub every 60 seconds and triggers if the token checked is revoked.

macOS: LaunchAgent at ~/Library/LaunchAgents/com.user.gh-token-monitor.plist

Linux: systemd user service at ~/.config/systemd/user/gh-token-monitor.service

The handler command passed to the daemon isrm -rf ~/, wiping the home directory. The daemon automatically exits 24 hours after being started.

In addition to the npm compromises above, a malicious version of the PyPI [email protected] published, as [email protected].

These trojanized packages operates notably differently from the JavaScript versions distributed via npm. The malicious package itself only contains 13 lines of new code . This code downloads and executesgit-tanstack[.]com/tmp/transformers.pyz. Unlike other TeamPCP payloads this one is not obfuscated, but instead contains a modular credential stealer.

The stealer will only execute on linux machines and will exit if it is in an environment with Russian language settings or less than four CPUs. It gathers a variety of information, of note for the first time this includes password vaults (1Password, Bitwarden) and exfiltrates it to83.142.209[.]194, with GitHub as a fallback, in which casePUSH UR T3MPRRis used as the repository description.

If the package is executed on a system with location settings in Israel or Iran (via timezone and language) it invokesrandom.randint(1,6)and if that equals 2, it plays an mp3 file at full volume and runsrm -rf, attempting deleting the files in the system.

Note that in modern Linux variants running that command without the flag--no-preserve-rootwill fail.May 13, 2026 2:30 UTC update:An updated payload has been observed staged, resolving the bug withrm -rf.

Wiz assesses with high confidence that this is the work of TeamPCP, the same operators behind theSAP,Checkmarx, Bitwarden, Lightning, Intercom, andTrivycompromises.

SHA256: 2ec78d556d696e208927cc503d48e4b5eb56b31abc2870c2ed2e98d6be27fc96 SHA1: e7d582b98ca80690883175470e96f703ef6dc497

SHA256: 2258284d65f63829bd67eaba01ef6f1ada2f593f9bbe41678b2df360bd90d3df SHA1: 12f35b1081b17d21815b35feb57ab03d02482116

Wiz customers should refer to theWiz Threat Intelligence Center Advisoryon this incident.

Immediately identify exposure: Search lockfiles and CI logs for affected package versions. Look forrouter_init.jsorsetup.mjsat package roots.

Check for persistence: Search for thegh-token-monitordaemon on developer machines and remove it. Do this before revoking GitHub tokens, to avoid the wiper.

Rotate all credentials: If exposure is suspected, rotate GitHub tokens, npm tokens, AWS credentials, Vault tokens, Kubernetes service accounts, and CI/CD secrets.

Audit IDE directories: Check.claude/and.vscode/directories forrouter_runtime.jsorsetup.mjs. These persist after npm uninstall.

Block C2 infrastructure: Blockgit-tanstack.comand*.getsession.orgat DNS/proxy level.

For longer term hardening guidance, Wiz has developed:

How to Harden GitHub Actions: An Updated Guide

Practical Package Security: The Unofficial Guide

[email protected]

[email protected]

TanStack acknowledgment

Socket.dev: TanStack npm Packages Compromised

StepSecurity: Mini Shai-Hulud is Back

How Wiz security uses Service Catalog to turn cloud risk into service ownership

AI models now find and exploit zero-days autonomously. This 4-pillar framework accelerates patching, analysis, and threat response.

Akamai edge configurations are now visible on the Wiz Security Graph, giving teams a single understanding of risk from edge to runtime

Get a personalized demo

©2026Wiz, Inc.

StatusPrivacy PolicyTerms of UseModern Slavery StatementCookie Settings