Article
TanStack worm: CI questions every team should ask
The TanStack npm worm chained a risky workflow, cache poisoning and a short-lived token. See the CI and monitoring questions a security lead should…
Read more
Malware profile
Mini Shai-Hulud
Mini Shai-Hulud is a credential stealer and self-replicating worm that spreads through software packages and build pipelines.
In short
Mini Shai-Hulud is a credential stealer and self-replicating worm that spreads through software packages and build pipelines. MITRE says it derives from Shai-Hulud and that the group TeamPCP has used it against CI/CD workflows. It steals cloud, container and developer credentials and uses stolen publishing tokens to push itself into more packages.
- Names3names in public reportsMini Shai-Hulud · Shai-Hulud · Miasma
- Techniques18ATT&CK techniques listedCredential Access · Initial Access · Execution
- Infection Steps6in the delivery chainPoison the build cache · Wait for a release run
- Linked Groups1groups that use itTeamPCP
In one minute
- What it is
- A self-replicating worm and credential stealer that spreads through npm and PyPI packages and CI/CD pipelines.
- What it does
- Steals cloud, Kubernetes, Vault, GitHub, npm and SSH credentials, uses stolen tokens to publish itself into more packages, and has a wiper part aimed at systems in Iran and Israel.
- Who uses it
- Attributed by CERT-EU (2 June 2026) and the FBI (2 July 2026) to the group TeamPCP. MITRE also lists TeamPCP as the group that uses it.
- How it gets in
- Trusted software packages. In the TanStack case, the attacker poisoned a build cache and stole a publishing token from the build runner, so the malicious versions looked legitimate.
- What to do first
- Treat any host that installed an affected package version as compromised, rotate every secret it could reach, and pin GitHub Actions to full commit hashes.
What it does
MITRE describes Mini Shai-Hulud as a credential stealer and supply chain worm that targets CI/CD workflows. It looks for secrets in cloud, container and AI configuration file paths, and it also has a targeted wiper component. The FBI uses the name for a campaign: a self-replicating worm that moves between the npm and PyPI software registries.
The best documented case is the compromise of the TanStack npm packages on 11 May 2026, which the project, GitHub and the NVD describe as CVE-2026-45321. CERT-EU adds that TeamPCP later published its malware source code and that copycat actors adopted it. The FBI names a variant called Miasma.
Names
Public sources use several names for this malware.
| Name | Where it appears |
|---|---|
| Mini Shai-Hulud | MITRE ATT&CK software S9043, the FBI FLASH and the CERT-EU cyber brief[1, 2, 3] |
| Shai-Hulud | MITRE says Mini Shai-Hulud is derived from Shai-Hulud (S9008). CERT-EU also uses this shorter name for the 11 May 2026 attack[1, 3] |
| Miasma | Variant of Mini Shai-Hulud named in the FBI FLASH[2] |
What it can do
What MITRE ATT&CK lists this malware as doing, by tactic. Each id opens our technique page where one exists, otherwise MITRE.
Credential Access
OS Credential Dumping: Proc Filesystem T1003.007
It reads the memory of the build runner process to pull out short-lived identity tokens, then swaps them for npm publishing tokens.[1]
Steal Application Access Token T1528
It steals application and CI/CD tokens.[1]
Unsecured Credentials: Credentials In Files T1552.001
It collects credentials kept in configuration files and in common credential file paths.[1]
Unsecured Credentials: Cloud Instance Metadata API T1552.005
It gathers credentials and secrets from the AWS, Google Cloud and Azure metadata services.[1]
Credentials from Password Stores: Password Managers T1555.005
It takes credentials stored in password managers, including password vaults.[1]
Credentials from Password Stores: Cloud Secrets Management Stores T1555.006
It captures credentials held in cloud secret stores.[1]
Initial Access
Execution
Lateral Movement
Command and Control
Web Service: Dead Drop Resolver T1102.001
It searches GitHub commits to find fallback server addresses stored in public repositories it created.[1]
Proxy: Multi-hop Proxy T1090.003
It can send stolen credentials out through the Session messenger network.[1, 4]
Fallback Channels T1008
When its main infrastructure cannot be reached, it sends data to GitHub instead.[1]
Exfiltration
Persistence
Stealth
Impact
How it spreads
The TanStack project says the attacker chained a risky pull_request_target workflow, GitHub Actions cache poisoning and the theft of a short-lived publishing token from the memory of the build runner, then published the malicious versions under a trusted identity. TanStack also says the malware finds other packages that the victim maintains and republishes them with the same injection. MITRE says it uses stolen npm and GitHub OIDC tokens to spread to other packages maintained by the compromised user. The FBI says the Miasma variant self-propagates across open-source registries such as npm and PyPI.
How an infection runs
The order of steps in a typical infection, as the sources describe it.
Poison the build cache
The attacker forked the TanStack repository, opened a pull request that triggered a pull_request_target workflow, and saved a poisoned cache entry for the main branch.[4]
Wait for a release run
A later release run on the main branch restored the poisoned cache, so the attacker's code ran on the build runner.[4]
Take the publishing token
The malware read the runner's memory and extracted the short-lived OIDC token.[4]
Publish trusted packages
It used the token to send publish requests straight to the npm registry, so 84 malicious versions of 42 packages looked genuine.[4, 5]
Steal on install
Installing an affected version ran a large obfuscated script that collected cloud, Kubernetes, Vault, GitHub and SSH secrets.[4, 5]
Send out and spread
Stolen data went out over the Session messenger network. The malware then found other packages the victim maintains and republished them.[4]
Timeline
- 10 May 2026
Attacker forks the repository
TanStack says that at 17:16 UTC the attacker created a fork of the TanStack router repository.[4]
- 11 May 2026
Pull request and poisoned cache
TanStack says the attacker opened a pull request at about 10:49 UTC and a poisoned 1.1 GB cache entry was saved at 11:29 UTC.[4]
- 11 May 2026
- 11 May 2026
Detection and removal
An external researcher opened a public issue at 19:46 UTC. The npm registry removed the affected tarballs between 22:13 and 23:55 UTC.[4]
- 11 May 2026
SDK packages of an AI vendor affected
Mistral says the worm led to compromised npm SDK packages uploaded on 11 May 2026 and a compromised PyPI release uploaded on 12 May 2026.[7]
- 12 May 2026
CVE-2026-45321 published
The NVD lists the CVE as published on 12 May 2026, with a CVSS 3.1 base score of 9.6 (critical).[6]
- 15 May 2026
TanStack all clear
After a three-day security sweep, TanStack issued an official all-clear.[4]
- 17 May 2026
Copycat use of leaked code
CERT-EU reports that independent actors began reusing TeamPCP's published malware code, including a clone in four typosquatted npm packages.[3]
- 2 June 2026
CERT-EU cyber brief
CERT-EU says TeamPCP's Mini Shai-Hulud worm compromised over 160 npm and PyPI packages.[3]
- 2 July 2026
FBI FLASH on TeamPCP
The FBI lists Mini Shai-Hulud and its variant Miasma among malware deployed by TeamPCP.[2]
Who uses it
Related vulnerabilities
Seen in
Detection and defense
Treat affected hosts as compromised
TanStack says any host that installed an affected version on 11 May 2026 must be treated as potentially compromised. Rotate AWS, GCP, Kubernetes, Vault, GitHub, npm and SSH credentials reachable from it and review cloud audit logs. The FBI also asks for rotation of all CI/CD secrets and publishing tokens.[2, 4]
Questions
What is Mini Shai-Hulud?
MITRE describes it as a credential stealer and self-replicating supply chain worm, derived from Shai-Hulud, used by TeamPCP to target CI/CD workflows since at least 2026. The FBI calls it a self-replicating, cross-ecosystem software supply chain worm campaign for npm and PyPI.
Who is behind Mini Shai-Hulud?
CERT-EU, in a brief of 2 June 2026, and the FBI, in a FLASH of 2 July 2026, attribute it to TeamPCP. MITRE also lists TeamPCP as the group that uses it. The FBI calls TeamPCP a cyber criminal group.
How did the TanStack attack work?
TanStack says the attacker chained a risky pull_request_target workflow, GitHub Actions cache poisoning and theft of a short-lived publishing token from runner memory. On 11 May 2026 this produced 84 malicious versions across 42 packages. TanStack says no npm tokens were stolen and its publish workflow was not changed.
Can Mini Shai-Hulud destroy data?
Yes in some cases. MITRE says it has a wiper component that targets hosts in Iran or Israel, and a switch that wipes the home directory if the attacker's GitHub token is revoked. CERT-EU describes a compromised PyPI package with a geo-fenced destructive payload aimed at Israel and Iran.
What should I do if I installed an affected package?
TanStack says to treat the host as potentially compromised, rotate cloud, Kubernetes, Vault, GitHub, npm and SSH credentials reachable from it, and review cloud audit logs.
In our research
- TanStack worm: CI questions every team should ask October 2026
- TeamPCP Threat group
Sources
- Mini Shai-Hulud, Software S9043 MITRE ATT&CKSupports: Description, platforms, techniques and the link to TeamPCP.
- Cyber Criminal Group TeamPCP (FLASH-20260702-01) FBISupports: Mini Shai-Hulud and Miasma listed as TeamPCP malware, recommendations and CVE references.
- Cyber Brief 26-06 - May 2026 CERT-EUSupports: Over 160 packages, the 11 May 2026 attack, the copycat reuse and attribution to TeamPCP.
- Postmortem: TanStack npm supply-chain compromise TanStackSupports: How the attack worked, the timeline, the payload and the response.
- Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys (GHSA-g7cv-rxg3-hmpx) GitHub Advisory DatabaseSupports: Advisory for CVE-2026-45321, the dependency trick and the workaround.
- CVE-2026-45321 NIST National Vulnerability DatabaseSupports: Publication date and CVSS score.
- TanStack supply chain attack affecting Mistral SDK packages (MAI-2026-002) Mistral AISupports: A victim disclosure linking the worm to compromised npm and PyPI SDK versions.
- Compromised mistralai PyPI package (GHSA-wx9m-wx4f-4cmg) GitHub Advisory DatabaseSupports: The PyPI upload bypassed the normal release pipeline and the second stage is unknown.
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.