---
title: "Responding to the Latest Mini-Shai-Hulud Supply Chain Attack"
description: "See technical details of the latest mini-Shai-Hulud supply-chain attack, including affected packages and remediation strategies."
canonical_url: "https://fossa.com/blog/responding-latest-mini-shai-hulud-supply-chain-attack/"
markdown_url: "https://fossa.com/blog/responding-latest-mini-shai-hulud-supply-chain-attack.md"
content_type: "blog"
language: "en"
date_published: "2026-05-14"
date_modified: "2026-05-14"
author: "Cortez Frazier Jr."
organization: "FOSSA"
---

# Responding to the Latest Mini-Shai-Hulud Supply Chain Attack

> See technical details of the latest mini-Shai-Hulud supply-chain attack, including affected packages and remediation strategies.

On May 11, 2026, a coordinated supply-chain attack published malicious versions of at least 235 packages across npm and PyPI. The attack was first reported by external security researchers including StepSecurity, Socket, safedep.io, and Wiz.

This version of Mini-Shai-Hulud first compromised 42  `@tanstack/*` npm packages before quickly spreading to Mistral AI, UiPath, OpenSearch, Guardrails AI, and dozens of other packages on both npm and PyPI.

In this blog, we’ll provide guidance to help FOSSA customers detect and remediate packages impacted by Mini-Shai-Hulud; we’ll also cover impacted packages and the attack mechanism.

## How the Mini-Shai-Hulud Attack Works

The attack ships an install-time payload through two delivery paths, one per ecosystem. Details are as follows.

### npm path

The campaign ships two npm delivery mechanisms.

The `@tanstack/*` packages add an `optionalDependencies` entry pointing at a Git-hosted package (for example, ``"@tanstack/setup:"github:tanstack/router#<orphan-commit>"``). When `npm install` resolves the Git dependency, it runs the dependency's `prepare` lifecycle hook, which executes the payload and then exits non-zero so the install logs look like an inert optional-dependency failure even though the malicious code has already run. Several of the same tarballs also include a ~2.3MB obfuscated file (`router_init.js`) staged inside the package itself.

The `@uipath/*` and Mistral AI npm packages use a more direct `preinstall` script (typically `node setup.mjs`) that downloads the Bun runtime and executes the payload before any application code runs. This is the same lifecycle-hook pattern seen in the earlier SAP CAP compromise that was an earlier version of the Shai-Hulud campaign, in late April 2026.

**Note:** Wiz [reported on May 13](https://www.wiz.io/blog/mini-shai-hulud-strikes-again-tanstack-more-npm-packages-compromised) that a bug in the payload renders the malware non-functional for the `@uipath/*` and `@mistralai/*` npm packages specifically; the PyPI `mistralai` package is not affected by this bug and should still be treated as fully compromised.

In both variants, the install-time execution fires before code review, before sandboxing, and before any application logic. A developer who pins a single version and runs `npm install` still gets the payload.

### PyPI path

The malicious PyPI distributions inject a dropper into the package's `__init__.py` (confirmed in `mistralai` version `2.4.6`). The dropper fires on `import mistralai` or `import guardrails`, including transitive imports from downstream code, and silently issues a `curl` request to `83.142.209.194`, saves the secondary payload to `/tmp/transformers.pyz`, and launches it as a detached background process that outlives the importing Python session.

This staged design defeats automated sandbox scanning that installs the package but never exercises its API: the sdist and wheel contain only the dropper, and the real credential-stealing logic lands on disk only after a real import call. Static analysis of the package contents will surface the dropper code, but not the secondary payload's behavior.

Once the payload runs, it walks the local filesystem and process environment for sensitive material:

* AWS IAM credentials from `~/.aws/credentials` and EC2 instance metadata
* GCP and Azure cloud credentials from the standard SDK config paths
* Kubernetes service-account tokens from in-cluster mount paths
* HashiCorp Vault tokens from `~/.vault-token`
* GitHub personal access tokens, OAuth tokens, and short-lived tokens matching `ghp_*`, `gho_*`, and `ghs_*`
* GitHub Actions OIDC tokens from the CI environment
* GitLab and CircleCI CI/CD tokens from the runner environment
* npm publish tokens from `~/.npmrc`

Exfiltration goes over the Session messaging protocol to `filev2.getsession[.]org`. A secondary command-and-control channel is hosted at `git-tanstack[.]com`. There is also evidence of IDE poisoning: committed modifications to `~/.claude/setup.mjs`, `~/.claude/router_runtime.js`, `~/.vscode/tasks.json`, and `~/.vscode/setup.mjs` designed to persist execution into developer tooling so that a wipe-and-reinstall of the affected dependency does not necessarily evict the implant.

## Packages Impacted by Mini-Shai-Hulud

The 235 affected packages can be roughly grouped into three distinct buckets.

### Brand Takeover of Legitimate Scopes

The attackers published malicious versions under official scopes for projects with significant install counts:

- ``@uipath/*``: 65 packages including `@uipath/cli`, `@uipath/agent-sdk`, `@uipath/orchestrator-tool`, and the bulk of the official RPA tooling
- ``@tanstack/*``: 42 packages including `@tanstack/react-router` (12M+ weekly downloads), `@tanstack/vue-router`, the eslint plugins, `query`, `history`, and `store`
- ``@squawk/*``: 22 packages across the aviation data toolkit (`airport-data`, `airspace`, `flightplan`, `navaids`, `weather`)
- ``@tallyui/*``: 10 packages across the e-commerce UI suite
- ``@mistralai/*``: 3 packages, the official `mistralai`, `mistralai-azure`, and `mistralai-gcp` SDKs
- ``@opensearch-project/opensearch``: the official OpenSearch JavaScript client (1M+ weekly downloads)

### Smaller-Scope Takeovers and Pivots

Each of `@aoflcorp`, `@apps-legacy-reports`, `@beproduct`, `@catladder`, `@dirigible-ai`, `@draftauth`, `@draftlab`, `@epambot`, `@housecallpro`, `@lir-portal`, `@mesadev`, `@mimecast-ui`, `@ml-toolkit-ts`, `@supersurkhet`, `@taskflow-corp`, and `@tolka` had between one and three packages compromised.

### Unscoped Typosquats and Pivots

Roughly 62 unscoped npm packages target plausible-looking names. The clusters include developer tooling (`agentwork-cli`, `cmux-agent-mcp`, `cross-stitch`, `git-branch-selector`, `git-git-git`, `nextmove-mcp`, `safe-action`, `ssh2-mcp-tools`, `ts-dna`, `wot-api`), crypto and DeFi names (`marginfi-client-v2`, `mrgn-common`, `mrgn-ui`, `mrgn-utils`, `orbiter-finance-bridge`, `orbiter-finance-bridge-sdk`, multiple `zircuit-*` packages), and a handful of obviously low-effort decoys (`hello-world-pkg-value-value-v`, `totally-legit-web-pack`, `super-useful-omega-package-123`).

On PyPI, the four affected packages are `mistralai` (the same SDK family that appears on the npm side), `guardrails-ai`, `numpy-fast` (two malicious versions), and `test4iqserv`.

## Using FOSSA to Manage Mini-Shai-Hulud

Customers can use the FOSSA platform to detect versions of packages impacted by Mini-Shai-Hulud. Below is a step-by-step guide to doing so.

1. Scan the latest revision of your FOSSA-tracked repositories.

2. Search **Quality: Issues**, filtered by issue type **Malware**, for any of the affected scopes or packages above.

3. If a match is found, remove the dependency, pin to the legitimate upstream package, and rotate any credentials that may have been exposed on the affected hosts. The credential classes to rotate are AWS IAM, GitHub PATs and OIDC tokens, npm publish tokens, and Vault tokens.

4. Audit CI build logs from May 11 forward for unexpected network egress to `filev2.getsession[.]org` or `git-tanstack[.]com`.

5. Inspect your developer environment for unauthorized modifications to `~/.claude/setup.mjs`, `~/.claude/router_runtime.js`, `~/.vscode/tasks.json`, and `~/.vscode/setup.mjs`.

We also encourage FOSSA customers to get in touch with your customer success contact if you need help scoping the blast radius. If you aren’t currently a FOSSA customer, you can reach out to our experts by [requesting a demo on our website](https://fossa.com/request-demo/).

## Source

Canonical page: https://fossa.com/blog/responding-latest-mini-shai-hulud-supply-chain-attack/