MAL-2026-3602

    Dashboard / Malicious Package / MAL-2026-3602

    MAL-2026-3602

    Published: 12 May 2026Last Modified: 12 May 2026

    Summary: Malicious code in @ml-toolkit-ts/xgboost (npm)

    Details: Source: google-open-source-security (5e1924464368f0c5816ee84e000cc47017f44045140feafbbc9e685d847ed5a5) This package was compromised as part of the "Mini Shai-Hulud is back" worm by the TeamPCP threat actor. The package will steal credentials and then propogate it to every package it has access to. The package also attempts to remain persistent.

    References: https://www.aikido.dev/blog/mini-shai-hulud-is-back-tanstack-compromised, https://www.stepsecurity.io/blog/mini-shai-hulud-is-back-a-self-spreading-supply-chain-attack-hits-the-npm-ecosystem, https://socket.dev/blog/tanstack-npm-packages-compromised-mini-shai-hulud-supply-chain-attack, https://tanstack.com/blog/npm-supply-chain-compromise-postmortem, https://snyk.io/blog/tanstack-npm-packages-compromised/

    Affected packages

    Package

    Name: @ml-toolkit-ts/xgboost

    Purl: pkg:npm/%40ml-toolkit-ts/xgboost

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.3
    1.0.4
    MAL-2026-3602 | CVE-DB