Mini Shai-Hulud v3 — TanStack/UiPath/Mistral AI npm & PyPI Supply Chain Compromise (TeamPCP)
Mini Shai-Hulud v3 (TL-2026-0499), also tracked as Mini Shai-Hulud v3, is a critical-severity supply-chain compromise, first published 2026-05-12. It is attributed to TeamPCP with high confidence, affects TanStack @tanstack/react-router, maps to 25 MITRE ATT&CK techniques (T1005, T1027, T1036), and is covered by 9 detection rules and 30 indicators of compromise.
Key facts for TL-2026-0499
- Threat ID
- TL-2026-0499
- Also known as
- Mini Shai-Hulud v3, Mini Shai-Hulud
- Severity
- CRITICAL
- Status
- ACTIVE
- Category
- SUPPLY_CHAIN
- First published
- 2026-05-12
- Last reviewed
- 2026-05-12
- Attribution
- TeamPCP
- Attribution confidence
- HIGH
- Motivation
- FINANCIAL
- Target sectors
- technology, software-development, ai-ml, enterprise-software, devops, cloud, financial
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 30
Malware and tooling in Mini Shai-Hulud v3
Malware and tooling: Session Messenger Network
On 11 May 2026, the threat actor TeamPCP executed a coordinated supply-chain attack against npm and PyPI ecosystems, compromising packages including @tanstack/react-router (~12M weekly downloads), @uipath/* namespace (60+ packages), @mistralai/mistralai, mistralai@2.4.6 (PyPI), and guardrails-ai@0.10.1 (PyPI) — 131+ total affected packages. The attack exploited GitHub Actions CI/CD pipeline weaknesses (pull_request_target workflow poisoning and cache injection) to extract OIDC tokens and publish malicious versions. Payloads function as self-propagating credential-stealing worms with destructive wiper capabilities (rm -rf ~/), exfiltrating tokens via a novel triple C2 infrastructure (typosquat domain, Session messenger network, GitHub API dead drops).
How Mini Shai-Hulud v3 works
TeamPCP, attributed with high confidence by Wiz Research, executed its third documented large-scale supply-chain attack (Mini Shai-Hulud v3) on 11 May 2026, targeting npm and PyPI ecosystems. This follows the operator's prior compromises of SAP, Checkmarx, Bitwarden, Lightning, Intercom, and Trivy packages.
The TanStack compromise exploited a three-stage GitHub Actions attack chain. First, the attacker forked TanStack/router, renaming the fork to zblgg/configuration for evasion, and submitted a pull request that triggered a pull_request_target workflow — a dangerous GitHub Actions pattern that executes with write repository permissions even for external PRs. The workflow poisoned the pnpm package store cache with malicious content. When legitimate PRs were merged and release workflows ran, they restored the poisoned cache, enabling extraction of OIDC tokens directly from GitHub Actions runner process memory (/proc/<pid>/mem). These stolen tokens were used to publish malicious package versions to npm without any credential compromise of maintainer accounts.
The UiPath namespace compromise used a preinstall hook (node setup.mjs) that downloaded the Bun JavaScript runtime (v1.3.13) and executed an obfuscated payload — identical delivery mechanism to the prior SAP compromise, re-obfuscated with a different campaign key but pointing to the same C2 infrastructure.
The Python ecosystem variant (guardrails-ai@0.10.1 and mistralai@2.4.6) contained a minimal 13-line downloader fetching and executing transformers.pyz from git-tanstack.com/tmp/. This unobfuscated modular credential stealer is Linux-only and exits gracefully if the system locale is Russian or if fewer than 4 CPU cores are detected — an anti-analysis and geopolitical evasion measure. Notably, this version includes first-documented password vault targeting (1Password, Bitwarden vaults).
All payloads function as self-propagating credential-stealing worms targeting: GitHub Actions OIDC tokens, GitLab and CircleCI tokens, AWS IMDSv2 credentials, GCP and Azure credentials, Kubernetes service account tokens, HashiCorp Vault tokens, and npm/package registry tokens. A persistent monitoring daemon (gh-token-monitor) is installed as a macOS LaunchAgent (~/Library/LaunchAgents/com.user.gh-token-monitor.plist) or Linux systemd user service (~/.config/systemd/user/gh-token-monitor.service). This daemon polls the GitHub API every 60 seconds and, critically, upon detecting token revocation (HTTP 40x response), executes rm -rf ~/ to destroy the victim home directory — a destructive wiper triggered by incident response actions. The daemon self-terminates after 24 hours.
The C2 infrastructure represents a significant evolution: a triple-layer architecture comprising (1) typosquat domain git-tanstack.com for payload hosting, (2) decentralized encrypted exfiltration via the Session messenger network (*.getsession.org) to recipient ID 05f9e609d79eed391015e11380dee4b5c9ead0b6e2e7f0134e6e51767a87323026, and (3) GitHub API dead drops where stolen tokens are stored in Dune-themed repositories (description: 'Shai-Hulud: Here We Go Again'). A commit with message 'IfYouRevokeThisTokenItWillWipeTheComputerOfTheOwner' served as an explicit threat indicator. Self-propagation uses stolen npm tokens and GitHub OIDC to publish poisoned versions of additional packages the victim can write to, exponentially expanding the attack blast radius.
In total, 131+ npm packages across 15+ namespaces were compromised including @tanstack (12M weekly downloads on react-router alone), @uipath (60+ packages), @mistralai, @beproduct, @cap-js, @dirigible-ai, @draftauth, @draftlab, @mesadev, @ml-toolkit-ts, @opensearch-project, @squawk, @supersurkhet, @tallyui, @taskflow-corp, and @tolka. Runtime artifacts (router_runtime.js, tanstack_runner.js) persist in IDE directories (.claude/, .vscode/) even after npm uninstall, requiring manual remediation. BeaconBeagle lookup for C2 IP 83.142.209.194 returned no prior beacon hits — infrastructure appears freshly stood up for this campaign.
MITRE ATT&CK techniques used in TL-2026-0499
Collection
Defense Evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1497.001 Virtualization/Sandbox Evasion: System Checks; T1564.001 Hide Artifacts: Hidden Files and Directories
Exfiltration
T1041 Exfiltration Over C2 Channel
Execution
T1059.006 Command and Scripting Interpreter: Python; T1059.007 Command and Scripting Interpreter: JavaScript; T1072 Software Deployment Tools
Command and Control
T1071.001 Application Layer Protocol: Web Protocols; T1102.001 Web Service: Dead Drop Resolver; T1573 Encrypted Channel
Discovery
T1082 System Information Discovery; T1083 File and Directory Discovery
Initial Access
T1195.001 Compromise Software Dependencies and Development Tools; T1199 Trusted Relationship
Impact
T1485 Data Destruction; T1496 Resource Hijacking
Credential Access
T1528 Steal Application Access Token; T1552.001 Unsecured Credentials: Credentials In Files
Persistence
T1543.001 Create or Modify System Process: Launch Agent; T1543.002 Create or Modify System Process: Systemd Service
Resource Development
T1583.001 Acquire Infrastructure: Domains; T1586.003 Cloud Accounts; T1608.001 Stage Capabilities: Upload Malware
Affected products and versions in Mini Shai-Hulud v3
- TanStack — @tanstack/react-router
Vulnerable versions: 1.169.5; 1.169.8 - Mistral AI — @mistralai/mistralai
Vulnerable versions: 2.2.2; 2.2.3; 2.2.4 - Mistral AI — mistralai
Vulnerable versions: 2.4.6 - UiPath — @uipath/* namespace
Vulnerable versions: multiple - Guardrails AI — guardrails-ai
Vulnerable versions: 0.10.1 - Multiple — Additional npm namespaces (131+ packages total)
Vulnerable versions: multiple
Remediation for Mini Shai-Hulud v3
Immediate actions
- Search lock files (package-lock.json, pnpm-lock.yaml, yarn.lock) and CI pipeline logs for @tanstack/react-router@1.169.5 or 1.169.8, @mistralai/mistralai@2.2.2-2.2.4, guardrails-ai@0.10.1, mistralai@2.4.6
- Check for router_init.js or setup.mjs at npm package roots before taking any further action
- CRITICAL: Search all developer machines and CI environments for gh-token-monitor daemon — REMOVE DAEMON BEFORE REVOKING ANY TOKENS to prevent rm -rf ~/ wiper activation
- Remove macOS LaunchAgent: ~/Library/LaunchAgents/com.user.gh-token-monitor.plist
- Remove Linux systemd service: ~/.config/systemd/user/gh-token-monitor.service
- Search IDE config directories (~/.claude/, .vscode/) for router_runtime.js or tanstack_runner.js — these persist after npm uninstall
- Block git-tanstack.com and *.getsession.org (seed1, seed2, seed3, filev2) at DNS and perimeter firewall immediately
- Block 83.142.209.194 at perimeter firewall
- After daemon removal: rotate ALL potentially exposed credentials — GitHub tokens, npm tokens, AWS IAM/IMDS, GCP service accounts, Azure credentials, Kubernetes service account tokens, HashiCorp Vault tokens, CI/CD secrets (GitHub Actions, GitLab CI, CircleCI)
- Audit all npm packages your account has publish access to — stolen tokens may have published poisoned versions
Workarounds
- Upgrade @tanstack/react-router to a clean version — verify via npm provenance attestation
- Upgrade @mistralai/mistralai to a vendor-confirmed clean version
- Remove guardrails-ai@0.10.1 and mistralai@2.4.6 — upgrade to registry-confirmed clean versions
Longer-term hardening
- Implement GitHub Actions security: pin all actions to full commit SHAs, restrict pull_request_target workflow permissions to read-only, never cache secrets in CI artifacts or pnpm/npm stores
- Enforce npm MFA for all package maintainers and use granular scoped publish tokens
- Deploy Software Composition Analysis (SCA) in CI/CD pipelines to detect malicious package versions pre-install
- Implement network egress filtering in CI/CD environments — flag unexpected connections to non-registry domains during npm install
- Monitor for /proc/<pid>/mem access in CI/CD runners — indicates OIDC token extraction attempts
- Implement Sigstore/cosign package signing and enforce provenance verification
- Use dependency pinning with full SHA hash verification for production package installs
- Enroll in npm package provenance attestation to cryptographically link packages to source repos
- Deploy endpoint monitoring for gh-token-monitor service name creation events
- Implement monitoring for unexpected LaunchAgent or systemd service creation by developer tools
Weaknesses (CWE) in Mini Shai-Hulud v3
CWE-494, CWE-829, CWE-506, CWE-522
Timeline of Mini Shai-Hulud v3
- TeamPCP operator conducted prior supply-chain compromises targeting SAP, Checkmarx, Bitwarden, Lightning, Intercom, and Trivy npm packages, establishing the Mini Shai-Hulud campaign series
- Malicious payloads began self-propagation using stolen npm tokens and GitHub OIDC, publishing poisoned versions of additional packages with victim write access — amplifying blast radius across dependent ecosystems
- gh-token-monitor persistence daemons installed on victim developer machines and CI environments; credential exfiltration commenced via triple C2: git-tanstack.com, Session messenger network, and GitHub API dead drop repositories
- Malicious versions published to npm (131+ packages including @tanstack/react-router 1.169.5/1.169.8, @mistralai/mistralai 2.2.2-2.2.4, 60+ @uipath/* packages) and PyPI (mistralai@2.4.6, guardrails-ai@0.10.1) using stolen tokens
- Malicious CI workflow extracted GitHub Actions OIDC tokens from runner process memory (/proc/<pid>/mem), providing capability to publish to npm registries without maintainer credential access
- TeamPCP submitted malicious pull request from fork zblgg/configuration (renamed TanStack/router fork), triggering pull_request_target workflow and injecting malicious content into GitHub Actions pnpm cache
- Security teams advised to remove gh-token-monitor daemon BEFORE revoking tokens to prevent wiper activation; registry removal confirmed; IOC block lists distributed to defenders
- Wiz Research published comprehensive advisory at 11:00 UTC documenting full attack chain, IOCs, and high-confidence attribution to TeamPCP. Malicious packages removed from npm and PyPI registries
- As of 2026-05-29, Mini Shai-Hulud v3 (TeamPCP/UNC6780) remains an active, escalating npm/PyPI supply-chain threat: the May 11 wave (TanStack, UiPath, Mistral — 131+ packages) was followed by the worm being open-sourced ~May 12, a ~640-package @antv wave ~May 19, and a ~3,800-repo GitHub-internal breach. No arrests or takedown have occurred; the self-propagating worm survives package removal, so the actor and tooling stay live.
Sources cited for Mini Shai-Hulud v3
- Mini Shai-Hulud Strikes Again: TanStack + more npm Packages Compromised
- TanStack Router GitHub Repository
- Malicious Orphan Commit in TanStack/router
- Prior TeamPCP Campaign: Checkmarx Supply Chain Compromise (TL-2026-0492)
- Prior TeamPCP Campaign: SAP Supply Chain Compromise (TL-2026-0439)
- Prior TeamPCP Campaign: Intercom Supply Chain Compromise (TL-2026-0446)
- GitHub Actions Security Hardening Guide
Threats related to Mini Shai-Hulud v3
- Nx Console VS Code Extension Backdoored (v18.95.0) — TeamPCP Mini Shai-Hulud Pivot from TanStack npm Worm to GitHub Internal Repository Breach (CVE-2026-48027)
- Backdoored Cemu v2.6 GitHub Release — TeamPCP Supply Chain Campaign Extends to Cemu Nintendo Wii U Emulator (cemu-project/Cemu)
- Keyv and Cacheable npm Supply Chain Attack via Compromised Maintainer Account (Shai-Hulud Malware)
- Mini Shai-Hulud Resurfaces — intercom-client@7.0.4 npm Worm Harvesting GitHub & Cloud Credentials (TeamPCP)
- lightning PyPI Package Compromise — Versions 2.6.2 & 2.6.3 Execute Bun-Based JavaScript Credential Stealer on Import (Shai-Hulud-Overlapping)
- durabletask PyPI Supply Chain Compromise (v1.4.1–1.4.3) — Microsoft-Published Azure Durable Functions SDK Trojanized w/ Cross-Cloud Credential Stealer + Linux Disk Wiper (TeamPCP / Mini Shai-Hulud)
Detection coverage for TL-2026-0499
As of 2026-05-12, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0499 across Splunk SPL, Microsoft KQL and Sigma, covering 30 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.