Mini Shai-Hulud Worm Compromises TanStack, Mistral AI, Guardrails AI & More Packages

The Mini Shai-Hulud worm, attributed to threat actor TeamPCP, has compromised multiple npm and PyPI packages including TanStack, Mistral AI, and Guardrails AI.

• •Modified packages include obfuscated JavaScript that steals credentials from cloud providers, cryptocurrency wallets, GitHub Actions, and CI systems, exfiltrating data to attacker-controlled servers.
• •The attack exploited GitHub Actions with OIDC tokens and cache poisoning to publish malicious versions with valid SLSA Build Level 3 provenance attestations.
• •The worm automatically spreads by locating publishable npm tokens and enumerating all packages by the same maintainer.
• •The TanStack incident (CVE-2026-45321, CVSS 9.6) impacted 42 packages and 84 versions, spreading to packages from UiPath, DraftLab, and others.

This summary was automatically generated by AI based on the original article and may not be fully accurate.