Mini Shai-Hulud Worm: Critical Supply Chain Attack Hits TanStack and npm Ecosystem

Mini Shai-Hulud: un gusano de cadena de suministro que explotó TanStack y el ecosistema npm.

The Mini Shai-Hulud campaign, orchestrated by TeamPCP, compromised over 170 packages including TanStack and Mistral AI. The attack utilized a credential-stealing worm with a critical CVSS severity of 9.6.

Why This Matters

This incident demonstrates that SLSA provenance and cryptographic signatures are insufficient if the CI/CD pipeline itself is compromised. By extracting OIDC tokens from memory, attackers can publish malicious code that appears legitimate to automated security scanners, effectively turning trusted infrastructure against its maintainers.

Key Insights

• Over 170 packages and 500 million downloads were affected by the CVE-2026-45321 vulnerability in 2026.
• Attackers extracted OIDC tokens from GitHub Actions runner memory (/proc/*/mem) to bypass MFA during npm publishing.
• The malware established persistence via VS Code and Claude Code configurations using hidden setup scripts.
• A PyPI variant targeted guardrails-ai and mistralai, showing the cross-ecosystem nature of the TeamPCP group.
• Traditional static scanners failed to detect the malware due to runtime obfuscation and second-stage payload delivery.

Working Examples

Malicious prepare script injected into the @tanstack/setup package to trigger the worm.

{\n  \"scripts\": {\n    \"prepare\": \"bun run tanstack_runner.js\"\n  }\n}

Practical Applications

• Use Case: Implementing GitHub Actions hardening by restricting OIDC scopes to specific deployment jobs. Pitfall: Allowing pull_request_target to run on unvalidated forks, leading to cache poisoning.
• Use Case: Rotating all secrets (AWS, GCP, npm) immediately if a vulnerable package version was installed in CI. Pitfall: Failing to remove local persistence files like .vscode/setup.mjs, allowing reinfection.

References:

• https://dev.to/bush1dom4koto/mini-shai-hulud-un-gusano-de-cadena-de-suministro-que-exploto-tanstack-y-el-ecosistema-npm-4df7