# Mini Shai-Hulud v3 — TanStack/UiPath/Mistral AI npm & PyPI Supply Chain Compromise (TeamPCP)

> On 11 May 2026, the threat actor TeamPCP executed a coordinated supply-chain attack against npm and PyPI ecosystems, compromising packages including @tanstack/react-router (~12M weekly downloads), @uipath/* namespace (60+ packages), @mistralai/mistralai, mistralai@2.4.6 (PyPI), and guardrails-ai@0.10.1 (PyPI) — 131+ total affected packages. The attack exploited GitHub Actions CI/CD pipeline weaknesses (pull_request_target workflow poisoning and cache injection) to extract OIDC tokens and publish malicious versions. Payloads function as self-propagating credential-stealing worms with destructive wiper capabilities (rm -rf ~/), exfiltrating tokens via a novel triple C2 infrastructure (typosquat domain, Session messenger network, GitHub API dead drops).

- **Published:** 2026-05-12T12:00:00Z
- **Last reviewed:** 2026-09-19T18:01:58.631Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0499
- **ID:** TL-2026-0499
- **Severity:** CRITICAL (CVSS 9.6)
- **Category:** SUPPLY_CHAIN
- **Status:** ACTIVE
- **Actor:** TeamPCP
- **Detections:** 9 · **IOCs:** 44 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-45321

## Description

TeamPCP, attributed with high confidence by Wiz Research, executed its third documented large-scale supply-chain attack (Mini Shai-Hulud v3) on 11 May 2026, targeting npm and PyPI ecosystems. This follows the operator's prior compromises of SAP, Checkmarx, Bitwarden, Lightning, Intercom, and Trivy packages.

The TanStack compromise exploited a three-stage GitHub Actions attack chain. First, the attacker forked TanStack/router, renaming the fork to zblgg/configuration for evasion, and submitted a pull request that triggered a pull_request_target workflow — a dangerous GitHub Actions pattern that executes with write repository permissions even for external PRs. The workflow poisoned the pnpm package store cache with malicious content. When legitimate PRs were merged and release workflows ran, they restored the poisoned cache, enabling extraction of OIDC tokens directly from GitHub Actions runner process memory (/proc/<pid>/mem). These stolen tokens were used to publish malicious package versions to npm without any credential compromise of maintainer accounts.

The UiPath namespace compromise used a preinstall hook (node setup.mjs) that downloaded the Bun JavaScript runtime (v1.3.13) and executed an obfuscated payload — identical delivery mechanism to the prior SAP compromise, re-obfuscated with a different campaign key but pointing to the same C2 infrastructure.

The Python ecosystem variant (guardrails-ai@0.10.1 and mistralai@2.4.6) contained a minimal 13-line downloader fetching and executing transformers.pyz from git-tanstack.com/tmp/. This unobfuscated modular credential stealer is Linux-only and exits gracefully if the system locale is Russian or if fewer than 4 CPU cores are detected — an anti-analysis and geopolitical evasion measure. Notably, this version includes first-documented password vault targeting (1Password, Bitwarden vaults).

All payloads function as self-propagating credential-stealing worms targeting: GitHub Actions OIDC tokens, GitLab and CircleCI tokens, AWS IMDSv2 credentials, GCP and Azure credentials, Kubernetes service account tokens, HashiCorp Vault tokens, and npm/package registry tokens. A persistent monitoring daemon (gh-token-monitor) is installed as a macOS LaunchAgent (~/Library/LaunchAgents/com.user.gh-token-monitor.plist) or Linux systemd user service (~/.config/systemd/user/gh-token-monitor.service). This daemon polls the GitHub API every 60 seconds and, critically, upon detecting token revocation (HTTP 40x response), executes rm -rf ~/ to destroy the victim home directory — a destructive wiper triggered by incident response actions. The daemon self-terminates after 24 hours.

The C2 infrastructure represents a significant evolution: a triple-layer architecture comprising (1) typosquat domain git-tanstack.com for payload hosting, (2) decentralized encrypted exfiltration via the Session messenger network (*.getsession.org) to recipient ID 05f9e609d79eed391015e11380dee4b5c9ead0b6e2e7f0134e6e51767a87323026, and (3) GitHub API dead drops where stolen tokens are stored in Dune-themed repositories (description: 'Shai-Hulud: Here We Go Again'). A commit with message 'IfYouRevokeThisTokenItWillWipeTheComputerOfTheOwner' served as an explicit threat indicator. Self-propagation uses stolen npm tokens and GitHub OIDC to publish poisoned versions of additional packages the victim can write to, exponentially expanding the attack blast radius.

In total, 131+ npm packages across 15+ namespaces were compromised including @tanstack (12M weekly downloads on react-router alone), @uipath (60+ packages), @mistralai, @beproduct, @cap-js, @dirigible-ai, @draftauth, @draftlab, @mesadev, @ml-toolkit-ts, @opensearch-project, @squawk, @supersurkhet, @tallyui, @taskflow-corp, and @tolka. Runtime artifacts (router_runtime.js, tanstack_runner.js) persist in IDE directories (.claude/, .vscode/) even after npm uninstall, requiring manual remediation. BeaconBeagle lookup for C2 IP 83.142.209.194 returned no prior beacon hits — infrastructure appears freshly stood up for this campaign.

## MITRE ATT&CK

- T1583.001 Acquire Infrastructure: Domains
- T1586.003 Cloud Accounts
- T1608.001 Stage Capabilities: Upload Malware
- T1195.001 Compromise Software Dependencies and Development Tools
- T1199 Trusted Relationship
- T1059.007 Command and Scripting Interpreter: JavaScript
- T1059.006 Command and Scripting Interpreter: Python
- T1072 Software Deployment Tools
- T1543.001 Create or Modify System Process: Launch Agent
- T1543.002 Create or Modify System Process: Systemd Service
- T1027 Obfuscated Files or Information
- T1036 Masquerading
- T1497.001 Virtualization/Sandbox Evasion: System Checks
- T1564.001 Hide Artifacts: Hidden Files and Directories
- T1528 Steal Application Access Token
- T1552.001 Unsecured Credentials: Credentials In Files
- T1082 System Information Discovery
- T1083 File and Directory Discovery
- T1005 Data from Local System
- T1071.001 Application Layer Protocol: Web Protocols
- T1102.001 Web Service: Dead Drop Resolver
- T1573 Encrypted Channel
- T1041 Exfiltration Over C2 Channel
- T1485 Data Destruction
- T1496 Resource Hijacking
- T1078 Valid Accounts
- T1546 Event Triggered Execution
- T1036.005 Masquerading: Match Legitimate Name or Location
- T1553 Subvert Trust Controls
- T1552.005 Unsecured Credentials: Cloud Instance Metadata API
- T1552.007 Unsecured Credentials: Container API
- T1020 Automated Exfiltration
- T1567 Exfiltration Over Web Service
- T1102 Web Service
- T1585 Establish Accounts

## Sources

- [Mini Shai-Hulud Strikes Again: TanStack + more npm Packages Compromised](https://www.wiz.io/blog/mini-shai-hulud-strikes-again-tanstack-more-npm-packages-compromised)
- [TanStack Router GitHub Repository](https://github.com/tanstack/router)
- [Malicious Orphan Commit in TanStack/router](https://github.com/tanstack/router/commit/79ac49eedf774dd4b0cfa308722bc463cfe5885c)
- [Prior TeamPCP Campaign: Checkmarx Supply Chain Compromise (TL-2026-0492)](https://intel.threadlinqs.com/threat/TL-2026-0492)
- [Prior TeamPCP Campaign: SAP Supply Chain Compromise (TL-2026-0439)](https://intel.threadlinqs.com/threat/TL-2026-0439)
- [Prior TeamPCP Campaign: Intercom Supply Chain Compromise (TL-2026-0446)](https://intel.threadlinqs.com/threat/TL-2026-0446)
- [GitHub Actions Security Hardening Guide](https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0499