Shai Hulud Malware Compromises TanStack, OpenAI, and Mistral AI in Sprawling Supply-Chain Attack

TeamPCP Launches Coordinated Attack on AI Developer Ecosystems

A sweeping AI supply-chain attack attributed to the TeamPCP threat group has compromised hundreds of software packages across npm and PyPI packages, targeting major AI companies including TanStack, Mistral AI, OpenAI, Guardrails AI, and UiPath. The campaign, known as Mini Shai Hulud malware, represents an escalation in developer infrastructure threats, with attackers publishing 84 malicious package versions across 42 TanStack packages in just six minutes 3

3

. Security firms Aikido, StepSecurity, and Socket tracked over 416 compromised package artifacts across multiple ecosystems, revealing the unprecedented scale of this cybersecurity incident 2

2

.

The attack exploited a critical weakness in how trusted software dependencies propagate through developer environments. Affected packages included @tanstack/react-router, @tanstack/history, @mistralai/mistralai, guardrails-ai, and opensearch-project components—collectively downloaded tens of millions of times per week 1

1

. What makes this campaign particularly dangerous is that the malicious code executed automatically during package installation or import, requiring no user interaction.

Valid Security Attestations Masked Compromised Software Packages

The Shai Hulud malware achieved something security researchers had never documented before: publishing malicious packages with valid SLSA Build Level 3 provenance attestations. TanStack revealed in its post-mortem that attackers chained three vulnerabilities—a risky pull_request_target workflow, GitHub Actions cache poisoning, and OpenID Connect tokens extraction from runner memory—to hijack the project's legitimate release pipeline 2

2

. The compromised packages carried legitimate GitHub Actions signatures and valid Sigstore attestations, making them appear cryptographically authentic from a developer's perspective 3

3

.

StepSecurity researcher Ashish Kurmi emphasized the severity: "The attack published malicious versions through the project's own GitHub Actions release pipeline using hijacked OIDC tokens" 2

2

. This represents the first documented npm worm that produces validly attested malicious packages, exposing fundamental limitations in current provenance verification systems. The trust model worked exactly as designed yet still produced dozens of malicious artifacts, highlighting critical CI/CD pipeline vulnerabilities that standard security measures failed to detect.

Credential Stealing Malware Targets Developer Secrets Across Platforms

The malicious code deployed comprehensive credential stealing malware capable of harvesting sensitive data from cloud providers, cryptocurrency wallets, AI tools, messaging apps, and CI systems including GitHub Actions. Microsoft Threat Intelligence reported that the compromised mistralai PyPI package version 2.4.6 contained malicious code in mistralai/client/init.py that silently downloaded a file from a remote IP address and executed it on Linux systems 1

1

. The filename deliberately resembled Hugging Face's Transformers framework to blend into machine learning environments.

The payload demonstrated sophisticated targeting logic, including country-aware code designed to avoid Russian-language environments and a geofenced destructive branch with a one-in-six chance of executing rm -rf / when systems appeared to be in Israel or Iran 2

2

. Security researchers found the malware read GitHub Actions process memory to collect GitHub credentials from more more than 100 file paths associated with cloud providers and cryptocurrency tokens. Stolen data was exfiltrated to the filev2.getsession[.]org domain using Session Protocol infrastructure—a deliberate choice to evade detection since the domain belongs to a decentralized messaging service unlikely to be blocked in enterprise environments 2

2

.

OpenAI Security Breach Exposes Code-Signing Certificates

OpenAI confirmed this week that the Shai Hulud malware campaign breached parts of its internal development environment through the compromised TanStack npm package. The company disclosed that malicious code infected two employee devices, granting attackers access to internal code storage systems 5

5

. In a blog post, OpenAI stated: "We observed activity consistent with the malware's publicly described behavior, including unauthorized access and credential-focused exfiltration activity, in a limited subset of internal source code repositories" 5

5

.

The impacted repositories included code-signing certificates used for OpenAI products on macOS, Windows, and iOS—critical assets that help operating systems verify software authenticity. As a precautionary measure, OpenAI is rotating all certificates and requiring macOS users to update their applications before June 12, 2026, after which older versions may stop functioning 5

5

. While OpenAI found no evidence of customer data or production system compromise, the incident underscores how attackers increasingly target shared software dependencies rather than individual companies.

Self-Propagating Worm Spreads Beyond Initial Targets

What distinguishes this campaign from previous supply-chain attacks is the malware's autonomous propagation capability. The self-propagating worm locates publishable npm tokens with bypass_2fa set to true, enumerates every package published by the same maintainer, and exchanges GitHub OIDC tokens for per-package publish tokens to sidestep traditional authentication entirely 2

2

. This mechanism enabled the malware to spread rapidly beyond TanStack to packages from UiPath, DraftLab, Mistral AI, and numerous other maintainers.

The worm also established persistence by writing itself into Claude Code hooks and Visual Studio Code auto-run tasks, ensuring it survives reboots and re-executes on every IDE launch 2

2

. Additionally, it installed a gh-token-monitor service to continuously monitor and re-exfiltrate GitHub tokens, and injected two malicious GitHub Actions workflows to serialize repository secrets into JSON objects for upload to external servers 2

2

. This multi-layered persistence strategy means uninstalling the compromised software packages alone does not eliminate the threat.

Mistral AI Compromise Demonstrates Cross-Ecosystem Reach

The Mistral AI compromise affected both npm SDK packages and PyPI distributions, demonstrating the campaign's ability to target multiple package ecosystems simultaneously. Affected Mistral packages included @mistralai/mistralai, @mistralai/mistralai-azure, and @mistralai/mistralai-gcp on npm, plus mistralai version 2.4.6 on PyPI 1

1

. Aikido warned developers to immediately rotate GitHub tokens, npm credentials, cloud API keys, and CI/CD secrets if affected packages had been installed 1

1

.

Socket noted that the guardrails-ai compromise was particularly concerning because the malicious code executes on import, checking for Linux systems before downloading a remote Python artifact from a domain designed to appear legitimate 2

2

. SafeDep researchers confirmed that although trigger mechanisms differed between compromised Mistral AI and TanStack packages, they deployed identical credential-stealing payloads, indicating coordinated campaign infrastructure 3

3

.

Industry Implications and Response Recommendations

This incident exposes a fundamental gap in how AI companies secure their release pipelines. VentureBeat reported that four supply-chain incidents hit OpenAI, Anthropic, and Meta within 50 days, with none targeting the AI models themselves but all exposing the same vulnerability: "release pipelines, dependency hooks, CI runners, and packaging gates that no system card, AISI evaluation, or Gray Swan red-team exercise has ever scoped" 4

4

. Model red teams do not cover release pipelines, creating blind spots that attackers now actively exploit.

Microsoft advised organizations to isolate affected Linux hosts, block outbound connections to malicious IP addresses, hunt for indicators including /tmp/transformers.pyz and pgsql-monitor.service, and rotate any potentially exposed credentials immediately 1

1

. Security teams should verify provenance, add behavioral analysis layers at install time, and enforce lockfile-only installs to prevent silent package updates 3

3

. Developers who downloaded affected package versions should assume credentials were exposed and take immediate remediation action. As attackers continue targeting shared software dependencies, the industry faces mounting pressure to implement architectural changes that extend security scrutiny beyond models to the entire development toolchain.