Mini Shai-Hulud Strikes Again: TanStack + more npm Packages Compromised

On 11 May 2026, TeamPCP launched a coordinated supply chain attack against the npm and PyPi ecosystems, compromising packages across multiple namespaces simultaneously. Impacted packages include:

• Packages in the  @tanstack namespace, which includes @tanstack/react-router, one of the most widely-used routing libraries in the React ecosystem with approximately 12 million weekly downloads.

• Packages in the @uipath namespace, which provides tooling for UiPath's enterprise automation platform, including @uipath/apollo-core, CLI tools, and agent SDKs.

• The @mistralai/mistralai package, which is the official TypeScript client for the Mistral AI platform. The mistralai PyPi packages was also impacted.

• The guardrails-ai LLM guardrails Python package.

See Affected Packages for detailed versions.

The npm team is aware of the campaign and has been acting quickly to remove the malicious package versions from the registry.

May 12, 2026, 11AM UTC update: Added additional IOCs and updated the affected packages table.

The TanStack vulnerability

The TanStack compromise exploited a chain of three vulnerabilities in GitHub Actions. The attacker created a fork of the TanStack/router repository (renamed to zblgg/configuration to evade fork-list searches), then opened a pull request that triggered a pull_request_target workflow. This workflow checked out and executed the attacker's fork code, which poisoned the GitHub Actions cache with a malicious pnpm store.

When legitimate maintainer PRs were later merged to main, the release workflow restored the poisoned cache. Attacker-controlled binaries then extracted OIDC tokens directly from the GitHub Actions runner's process memory (/proc/<pid>/mem). The attacker was able to use these tokens to publish the malicious package versions without ever stealing npm credentials.

The published packages contain two infection vectors: an optionalDependencies entry pointing to an orphan commit (github:tanstack/router#79ac49eedf774dd4b0cfa308722bc463cfe5885c) that executes a payload via a prepare script, and an embedded ~2.3MB obfuscated file router_init.js placed directly in the package tarball.

Shortly after the @tanstack attack, packages in the @uipath namespace were compromised. These packages use a preinstall script (node setup.mjs) that downloads the Bun runtime and executes the payload. This is the same delivery mechanism that was seen in the earlier SAP compromise. The UiPath variant uses a re-obfuscated version of the same payload with a different campaign key but identical C2 infrastructure.

When executed, the payload is a credential stealer and self-propagating worm. It targets CI/CD tokens (GitHub Actions OIDC, GitLab, CircleCI), cloud credentials (AWS IMDSv2, GCP, Azure), Kubernetes service accounts, HashiCorp Vault, and package registry tokens. It uses stolen npm tokens and GitHub Actions OIDC tokens to publish poisoned versions of additional packages the victim has write access to, functioning as a worm that spreads through the npm ecosystem.

The payload exfiltrates stolen credentials via three redundant channels: a typosquat domain (git-tanstack[.]com), the decentralized Session messenger network, and GitHub API dead drops using stolen tokens.

On developer machines, the malware installs a persistent gh-token-monitor daemon (via macOS LaunchAgent or Linux systemd) that polls GitHub every 60 seconds. On receiving a 40X error due to token revocation, the monitor attempts to run rm -rf ~/. The daemon automatically exits after 24 hours without triggering the destructive handler.

As with previous Mini Shai-Hulud variants, the malware checks if the system is configured for the Russian language and terminates without exfiltrating data if so.

Notable updates

This operation delivers a payload that uses the same methods used in previous TeamPCP operations but contains several notable evolutions.

Triple C2 architecture

The payload exfiltrates stolen credentials via three redundant channels:

1. Typosquat domain: https://git-tanstack[.]com

2. Session messenger network: Decentralized, encrypted exfiltration via *.getsession.org to recipient ID 05f9e609d79eed391015e11380dee4b5c9ead0b6e2e7f0134e6e51767a87323026

3. GitHub API dead drops: Creates Dune-themed repositories using stolen tokens with Shai-Hulud: Here We Go Again as the repo description.

The Session network channel is new. Decentralized and takedown-resistant, it is significantly harder to disrupt than dedicated domains or GitHub-based exfiltration.

GitHub token persistence wiper daemon

If the malware identifies any ghp_ (GitHub Personal Access Tokens) or gho_(Oauth Tokens) it runs them through a series of checks:

• It must be a valid token that contains a login field

• It must include repo or public_repo in its scope

• It must have a public profile

• It must have the ability to write to a repo

• It must be a member of an org

If these all pass the malware installs a persistent gh-token-monitor daemon that polls GitHub every 60 seconds and triggers if the token checked is revoked.

• macOS: LaunchAgent at ~/Library/LaunchAgents/com.user.gh-token-monitor.plist

• Linux: systemd user service at ~/.config/systemd/user/gh-token-monitor.service

The handler command passed to the daemon is rm -rf ~/, wiping the home directory. The daemon automatically exits 24 hours after being started.

Python Variant

In addition to the npm compromises above, a malicious version of the PyPI package guardrails-ai@0.10.1 was published, as was mistralai@2.4.6.

These trojanized packages operates notably differently from the JavaScript versions distributed via npm. The malicious package itself only contains 13 lines of new code . This code downloads and executes git-tanstack[.]com/tmp/transformers.pyz. Unlike other TeamPCP payloads this one is not obfuscated, but instead contains a modular credential stealer.  

The stealer will only execute on linux machines and will exit if it is in an environment with Russian language settings or less than four CPUs. It gathers a variety of information, of note for the first time this includes password vaults (1Password, Bitwarden) and exfiltrates it to 83.142.209[.]194, with GitHub as a fallback, in which case PUSH UR T3MPRR is used as the repository description.

If the package is executed on a system with location settings in Israel or Iran (via timezone and language) it invokes random.randint(1,6) and if that equals 2, it plays an mp3 file at full volume and runs rm -rf, attempting deleting the files in the system.

Note that in modern Linux variants running that command without the flag --no-preserve-root will fail.

Attribution

Wiz assesses with high confidence that this is the work of TeamPCP, the same operators behind the SAP, Checkmarx, Bitwarden, Lightning, Intercom, and Trivy compromises.

Indicators of compromise

Network indicators

Additional Indicators

What steps should security teams take?

Wiz customers should refer to the Wiz Threat Intelligence Center Advisory on this incident.

1. Immediately identify exposure: Search lockfiles and CI logs for affected package versions. Look for router_init.js or setup.mjs at package roots.

2. Check for persistence: Search for the gh-token-monitor daemon on developer machines and remove it. Do this before revoking GitHub tokens, to avoid the wiper.

3. Rotate all credentials: If exposure is suspected, rotate GitHub tokens, npm tokens, AWS credentials, Vault tokens, Kubernetes service accounts, and CI/CD secrets.

4. Audit IDE directories: Check .claude/ and .vscode/ directories for router_runtime.js or setup.mjs. These persist after npm uninstall.

5. Block C2 infrastructure: Block git-tanstack.com and *.getsession.org at DNS/proxy level.

For longer term hardening guidance, Wiz has developed:

• How to Harden GitHub Actions: An Updated Guide

• Practical Package Security: The Unofficial Guide

Affected packages

PyPi Packages

1. guardrails-ai@0.10.1

2. mistralai@2.4.6

npm Packages

References

• TanStack acknowledgment

• Socket.dev: TanStack npm Packages Compromised

• StepSecurity: Mini Shai-Hulud is Back