Threat reportSupply ChainTL-2026-0499
Mini Shai-Hulud v3 — TanStack/UiPath/Mistral AI npm & PyPI Supply Chain Compromise (TeamPCP)
Mini Shai-Hulud v3 (TL-2026-0499), also tracked as Mini Shai-Hulud v3, is a critical-severity supply-chain compromise scored CVSS 9.6, first published 2026-05-12 and last reviewed 2026-09-19. It is attributed to TeamPCP with high confidence, affects TanStack @tanstack/react-router, references 1 CVE (CVE-2026-45321), maps to 35 MITRE ATT&CK techniques (T1005, T1020, T1027), and is covered by 9 detection rules and 44 indicators of compromise.
- CVSS
- 9.6/10Critical
- CVEs
- 1Referenced vulnerabilities
- Techniques
- 35MITRE ATT&CK
- Actors
- 1TeamPCP
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 44Indicators of compromise
Key facts for TL-2026-0499
- Threat ID
- TL-2026-0499
- Also known as
- Mini Shai-Hulud v3, Mini Shai-Hulud
- Severity
- CRITICAL
- CVSS
- 9.6
- Status
- ACTIVE
- Category
- SUPPLY_CHAIN
- First published
- Last reviewed
- Attribution
- TeamPCP
- Attribution confidence
- HIGH
- Motivation
- FINANCIAL
- Target sectors
- technology, software-development, ai-ml, enterprise-software, devops, cloud, financial
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 44
- Updates
- 2026-09-19 · revalidated 1× · latest source
Malware and tooling in Mini Shai-Hulud v3
Malware and tooling: Session Messenger Network
How Mini Shai-Hulud v3 works
On 11 May 2026, the threat actor TeamPCP executed a coordinated supply-chain attack against npm and PyPI ecosystems, compromising packages including @tanstack/react-router (~12M weekly downloads), @uipath/* namespace (60+ packages), @mistralai/mistralai, mistralai@2.4.6 (PyPI), and guardrails-ai@0.10.1 (PyPI) — 131+ total affected packages. The attack exploited GitHub Actions CI/CD pipeline weaknesses (pull_request_target workflow poisoning and cache injection) to extract OIDC tokens and publish malicious versions. Payloads function as self-propagating credential-stealing worms with destructive wiper capabilities (rm -rf ~/), exfiltrating tokens via a novel triple C2 infrastructure (typosquat domain, Session messenger network, GitHub API dead drops).
TeamPCP, attributed with high confidence by Wiz Research, executed its third documented large-scale supply-chain attack (Mini Shai-Hulud v3) on 11 May 2026, targeting npm and PyPI ecosystems. This follows the operator's prior compromises of SAP, Checkmarx, Bitwarden, Lightning, Intercom, and Trivy packages.
The TanStack compromise exploited a three-stage GitHub Actions attack chain. First, the attacker forked TanStack/router, renaming the fork to zblgg/configuration for evasion, and submitted a pull request that triggered a pull_request_target workflow — a dangerous GitHub Actions pattern that executes with write repository permissions even for external PRs. The workflow poisoned the pnpm package store cache with malicious content. When legitimate PRs were merged and release workflows ran, they restored the poisoned cache, enabling extraction of OIDC tokens directly from GitHub Actions runner process memory (/proc/<pid>/mem). These stolen tokens were used to publish malicious package versions to npm without any credential compromise of maintainer accounts.
The UiPath namespace compromise used a preinstall hook (node setup.mjs) that downloaded the Bun JavaScript runtime (v1.3.13) and executed an obfuscated payload — identical delivery mechanism to the prior SAP compromise, re-obfuscated with a different campaign key but pointing to the same C2 infrastructure.
The Python ecosystem variant (guardrails-ai@0.10.1 and mistralai@2.4.6) contained a minimal 13-line downloader fetching and executing transformers.pyz from git-tanstack.com/tmp/. This unobfuscated modular credential stealer is Linux-only and exits gracefully if the system locale is Russian or if fewer than 4 CPU cores are detected — an anti-analysis and geopolitical evasion measure. Notably, this version includes first-documented password vault targeting (1Password, Bitwarden vaults).
All payloads function as self-propagating credential-stealing worms targeting: GitHub Actions OIDC tokens, GitLab and CircleCI tokens, AWS IMDSv2 credentials, GCP and Azure credentials, Kubernetes service account tokens, HashiCorp Vault tokens, and npm/package registry tokens. A persistent monitoring daemon (gh-token-monitor) is installed as a macOS LaunchAgent (~/Library/LaunchAgents/com.user.gh-token-monitor.plist) or Linux systemd user service (~/.config/systemd/user/gh-token-monitor.service). This daemon polls the GitHub API every 60 seconds and, critically, upon detecting token revocation (HTTP 40x response), executes rm -rf ~/ to destroy the victim home directory — a destructive wiper triggered by incident response actions. The daemon self-terminates after 24 hours.
The C2 infrastructure represents a significant evolution: a triple-layer architecture comprising (1) typosquat domain git-tanstack.com for payload hosting, (2) decentralized encrypted exfiltration via the Session messenger network (*.getsession.org) to recipient ID 05f9e609d79eed391015e11380dee4b5c9ead0b6e2e7f0134e6e51767a87323026, and (3) GitHub API dead drops where stolen tokens are stored in Dune-themed repositories (description: 'Shai-Hulud: Here We Go Again'). A commit with message 'IfYouRevokeThisTokenItWillWipeTheComputerOfTheOwner' served as an explicit threat indicator. Self-propagation uses stolen npm tokens and GitHub OIDC to publish poisoned versions of additional packages the victim can write to, exponentially expanding the attack blast radius.
In total, 131+ npm packages across 15+ namespaces were compromised including @tanstack (12M weekly downloads on react-router alone), @uipath (60+ packages), @mistralai, @beproduct, @cap-js, @dirigible-ai, @draftauth, @draftlab, @mesadev, @ml-toolkit-ts, @opensearch-project, @squawk, @supersurkhet, @tallyui, @taskflow-corp, and @tolka. Runtime artifacts (router_runtime.js, tanstack_runner.js) persist in IDE directories (.claude/, .vscode/) even after npm uninstall, requiring manual remediation. BeaconBeagle lookup for C2 IP 83.142.209.194 returned no prior beacon hits — infrastructure appears freshly stood up for this campaign.
MITRE ATT&CK techniques used in TL-2026-0499
Collection
Exfiltration
T1020 Automated Exfiltration; T1041 Exfiltration Over C2 Channel; T1567 Exfiltration Over Web Service
Defense Evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1036.005 Masquerading: Match Legitimate Name or Location; T1497.001 Virtualization/Sandbox Evasion: System Checks; T1553 Subvert Trust Controls; T1564.001 Hide Artifacts: Hidden Files and Directories
Execution
T1059.006 Command and Scripting Interpreter: Python; T1059.007 Command and Scripting Interpreter: JavaScript; T1072 Software Deployment Tools
Command and Control
T1071.001 Application Layer Protocol: Web Protocols; T1102 Web Service; T1102.001 Web Service: Dead Drop Resolver; T1573 Encrypted Channel
Initial Access
T1078 Valid Accounts; T1195.001 Compromise Software Dependencies and Development Tools; T1199 Trusted Relationship
Discovery
T1082 System Information Discovery; T1083 File and Directory Discovery
Impact
T1485 Data Destruction; T1496 Resource Hijacking
Credential Access
T1528 Steal Application Access Token; T1552.001 Unsecured Credentials: Credentials In Files; T1552.005 Unsecured Credentials: Cloud Instance Metadata API; T1552.007 Unsecured Credentials: Container API
Persistence
T1543.001 Create or Modify System Process: Launch Agent; T1543.002 Create or Modify System Process: Systemd Service; T1546 Event Triggered Execution
Resource Development
T1583.001 Acquire Infrastructure: Domains; T1585 Establish Accounts; T1586.003 Cloud Accounts; T1608.001 Stage Capabilities: Upload Malware
Affected products and versions in Mini Shai-Hulud v3
- TanStack — @tanstack/react-router
Vulnerable versions: 1.169.5; 1.169.8 - Mistral AI — @mistralai/mistralai
Vulnerable versions: 2.2.2; 2.2.3; 2.2.4 - Mistral AI — mistralai
Vulnerable versions: 2.4.6 - UiPath — @uipath/* namespace
Vulnerable versions: multiple - Guardrails AI — guardrails-ai
Vulnerable versions: 0.10.1 - Multiple — Additional npm namespaces (131+ packages total)
Vulnerable versions: multiple
Remediation for Mini Shai-Hulud v3
Immediate actions
- Search lock files (package-lock.json, pnpm-lock.yaml, yarn.lock) and CI pipeline logs for @tanstack/react-router@1.169.5 or 1.169.8, @mistralai/mistralai@2.2.2-2.2.4, guardrails-ai@0.10.1, mistralai@2.4.6
- Check for router_init.js or setup.mjs at npm package roots before taking any further action
- CRITICAL: Search all developer machines and CI environments for gh-token-monitor daemon — REMOVE DAEMON BEFORE REVOKING ANY TOKENS to prevent rm -rf ~/ wiper activation
- Remove macOS LaunchAgent: ~/Library/LaunchAgents/com.user.gh-token-monitor.plist
- Remove Linux systemd service: ~/.config/systemd/user/gh-token-monitor.service
- Search IDE config directories (~/.claude/, .vscode/) for router_runtime.js or tanstack_runner.js — these persist after npm uninstall
- Block git-tanstack.com and *.getsession.org (seed1, seed2, seed3, filev2) at DNS and perimeter firewall immediately
- Block 83.142.209.194 at perimeter firewall
- After daemon removal: rotate ALL potentially exposed credentials — GitHub tokens, npm tokens, AWS IAM/IMDS, GCP service accounts, Azure credentials, Kubernetes service account tokens, HashiCorp Vault tokens, CI/CD secrets (GitHub Actions, GitLab CI, CircleCI)
- Audit all npm packages your account has publish access to — stolen tokens may have published poisoned versions
Workarounds
- Upgrade @tanstack/react-router to a clean version — verify via npm provenance attestation
- Upgrade @mistralai/mistralai to a vendor-confirmed clean version
- Remove guardrails-ai@0.10.1 and mistralai@2.4.6 — upgrade to registry-confirmed clean versions
Longer-term hardening
- Implement GitHub Actions security: pin all actions to full commit SHAs, restrict pull_request_target workflow permissions to read-only, never cache secrets in CI artifacts or pnpm/npm stores
- Enforce npm MFA for all package maintainers and use granular scoped publish tokens
- Deploy Software Composition Analysis (SCA) in CI/CD pipelines to detect malicious package versions pre-install
- Implement network egress filtering in CI/CD environments — flag unexpected connections to non-registry domains during npm install
- Monitor for /proc/<pid>/mem access in CI/CD runners — indicates OIDC token extraction attempts
- Implement Sigstore/cosign package signing and enforce provenance verification
- Use dependency pinning with full SHA hash verification for production package installs
- Enroll in npm package provenance attestation to cryptographically link packages to source repos
- Deploy endpoint monitoring for gh-token-monitor service name creation events
- Implement monitoring for unexpected LaunchAgent or systemd service creation by developer tools
CVEs associated with Mini Shai-Hulud v3
Weaknesses (CWE) in Mini Shai-Hulud v3
Timeline of Mini Shai-Hulud v3
- TeamPCP operator conducted prior supply-chain compromises targeting SAP, Checkmarx, Bitwarden, Lightning, Intercom, and Trivy npm packages, establishing the Mini Shai-Hulud campaign series
- Attacker-controlled GitHub account 'voicproducoes' (ID 269549300) created, later used to stage the malicious fork of TanStack/router.
- Attacker forks TanStack/router as github.com/zblgg/configuration and commits a ~30KB obfuscated payload the day before the pull_request_target trigger fired.
- All 84 malicious npm versions deprecated by 21:03 UTC and tarballs fully removed by 23:55 UTC — same-day containment, ahead of the 2026-05-12 Wiz advisory.
- StepSecurity researcher ashishkurmi reports the compromise roughly 26 minutes after publication, via anomalous tarball size and an injected optionalDependency.
- Malicious payloads began self-propagation using stolen npm tokens and GitHub OIDC, publishing poisoned versions of additional packages with victim write access — amplifying blast radius across dependent ecosystems
- gh-token-monitor persistence daemons installed on victim developer machines and CI environments; credential exfiltration commenced via triple C2: git-tanstack.com, Session messenger network, and GitHub API dead drop repositories
- Malicious versions published to npm (131+ packages including @tanstack/react-router 1.169.5/1.169.8, @mistralai/mistralai 2.2.2-2.2.4, 60+ @uipath/* packages) and PyPI (mistralai@2.4.6, guardrails-ai@0.10.1) using stolen tokens
- Malicious CI workflow extracted GitHub Actions OIDC tokens from runner process memory (/proc/<pid>/mem), providing capability to publish to npm registries without maintainer credential access
- TeamPCP submitted malicious pull request from fork zblgg/configuration (renamed TanStack/router fork), triggering pull_request_target workflow and injecting malicious content into GitHub Actions pnpm cache
- Security teams advised to remove gh-token-monitor daemon BEFORE revoking tokens to prevent wiper activation; registry removal confirmed; IOC block lists distributed to defenders
- Wiz Research published comprehensive advisory at 11:00 UTC documenting full attack chain, IOCs, and high-confidence attribution to TeamPCP. Malicious packages removed from npm and PyPI registries
- A GitHub OAuth token stolen from a former CrowdSec employee's May-11-compromised workstation is used to clone ~170 private CrowdSec repositories from a Toronto, Canada IP address.
- CrowdSec removes the former employee's GitHub organization access, unaware the repositories had already been cloned three days earlier.
- CVE-2026-45321 (assigned for the TanStack compromise) is added to CISA's Known Exploited Vulnerabilities catalog.
- As of 2026-05-29, Mini Shai-Hulud v3 (TeamPCP/UNC6780) remains an active, escalating npm/PyPI supply-chain threat: the May 11 wave (TanStack, UiPath, Mistral — 131+ packages) was followed by the worm being open-sourced ~May 12, a ~640-package @antv wave ~May 19, and a ~3,800-repo GitHub-internal breach. No arrests or takedown have occurred; the self-propagating worm survives package removal, so the actor and tooling stay live.
- An unknown party attempts to use a stolen, scope-restricted AWS SNS credential from the CrowdSec archive; the attempt does not escalate further.
- Stolen CrowdSec source code (SaaS console, AWS automation scripts, IP-reputation scoring logic) surfaces on a cybercrime forum, alongside 83 user emails and 51 investor contacts.
- CrowdSec completes credential rotation and publishes a public incident statement tracing the breach to the May TanStack compromise.
Update history for TL-2026-0499
- 2026-09-19 — TanStack npm Supply Chain Attack (CVE-2026-45321) Exposes 170 Private CrowdSec Repositories via Mini Shai-Hulud Wave 4: What changed CVSS filled in (null → 9.6) now that CVE-2026-45321 has been assigned and added to CISA KEV. New indicators (14) 14 new IOCs: 2 secondary payload domains (litter.catbox.moe, api.masscan.cloud) and their payload URLs, 2 new pers
Sources cited for Mini Shai-Hulud v3
- Mini Shai-Hulud Strikes Again: TanStack + more npm Packages Compromised
- TanStack Router GitHub Repository
- Malicious Orphan Commit in TanStack/router
- Prior TeamPCP Campaign: Checkmarx Supply Chain Compromise (TL-2026-0492)
- Prior TeamPCP Campaign: SAP Supply Chain Compromise (TL-2026-0439)
- Prior TeamPCP Campaign: Intercom Supply Chain Compromise (TL-2026-0446)
- GitHub Actions Security Hardening Guide
Detection coverage for TL-2026-0499
As of 2026-09-19, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0499 across Splunk SPL, Microsoft KQL and Sigma, covering 44 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.