Mini Shai-Hulud npm worm hits TanStack, Mistral SDK, OpenAI
Confirmed
The takeaway
OpenAI said on May 13–14 that two employee devices were hit and that limited credential material, including code-signing material, was exfiltrated, so it rotated certificates and required macOS app updates.
Status
- Claim
Confirmed
- Our reporting
- High confidence
- Importance
- 3 of 5
- Last verified
- 14 October 2026
Your AI and this story
- GPT-6 Astra11 days after its cutoff
- Claude Opus 5.5In its training data
- Gemini 4 Argon41 days after its cutoff
- Grok 4.7In its training data
It is after the cutoff of GPT-6 Astra and Gemini 4 Argon, and can be in the training data of Claude Opus 5.5 and Grok 4.7.
Key facts
- TanStack: 84 malicious versions across 42 @tanstack/* packages published May 11, 19:20–19:26 UTC; attackers chained a pull_request_target ‘Pwn Request’, cross-fork cache poisoning and OIDC-token extraction from runner memory, so the builds carried valid SLSA provenance (BleepingComputer, SafeDep)
- Scope estimates differ: 404 malicious versions across 172 npm and 2 PyPI packages (one count); Socket 416 artifacts; OWASP GenAI: more than 170 packages with over 518M downloads. Also hit: UiPath, OpenSearch JavaScript and Guardrails AI packages
- Mistral: malicious mistralai==2.4.6 Python SDK; Mistral’s advisory says an affected developer workstation was the cause, with no impact on its global infrastructure
- OpenAI: two employee devices affected; ‘limited, credential-focused’ exfiltration from a small subset of internal source repositories; no evidence that ‘customer data, production systems, intellectual property, or software were compromised’; sessions revoked, credentials and code-signing certificates rotated, a forensics firm hired; macOS users had to update ChatGPT and Codex apps by June 12 (MT Newswires, May 14)
- AI-tool persistence: the worm planted a Claude Code hook and a VS Code task that survived uninstalling the package (OWASP GenAI)
- Miasma / Hades waves (mid-May to early June): 32 Red Hat cloud-services npm packages backdoored and 73 Microsoft repositories disabled by GitHub; config files for Claude Code, Gemini CLI, Cursor and VS Code ran code when a repository was opened, with no install step (OWASP GenAI)
- Attribution: TeamPCP, the group also blamed for the March LiteLLM compromise behind the Mercor breach
What happened
Attackers abused TanStack’s GitHub Actions setup to publish poisoned releases through its real release pipeline, so the packages looked legitimate and even had signed provenance. The payload stole cloud, CI, npm, crypto-wallet and AI-tool credentials and spread to other packages, including Mistral AI’s Python SDK. OpenAI was one of the victims: two staff machines installed an affected package.
A Cloud Security Alliance note reported a geofenced destructive branch (a one-in-six chance of wiping disks on machines located in Israel or Iran); other sources read here do not confirm it.
Why it matters
It was the year’s clearest case of a supply-chain worm aimed at AI developers and their tools: two AI labs were hit, and the malware persisted through AI coding-agent configuration (Claude Code hooks, then config files for several agents in the Miasma wave). It showed that build-provenance attestations can be defeated and that agent config directories need to be treated as executable code.
Sources
7 sources from 7 sites. Numbers match the chips in the text.
7 sources: 2 primary, 3 press, 2 reactions
Primary
- Mistral AI docs: security advisoriesdocs.mistral.ai, official
- OpenAI: Our response to the TanStack npm supply chain attack (returns 403 to our fetcher)openai.com, official
Press
- BleepingComputer: Shai-Hulud attack ships signed malicious TanStack, Mistral npm packagesbleepingcomputer.com, press
- MT Newswires via Placera: OpenAI says 2 devices compromised in TanStack npm supply chain attack (May 14)placera.se, press
- Infosecurity Magazine: Mini Shai-Hulud hits TanStack npm packagesinfosecurity-magazine.com, press
Reactions
- OWASP GenAI: GenAI and agentic AI exploit roundup, Q3 2026 (Oct 8)genai.owasp.org, discussion
- SafeDep: Mass supply chain attack hits TanStack, Mistral AI npm and PyPI packagessafedep.io, discussion
Changes
- Filed. OpenAI’s own post still returns 403