---
id: "2026-05-11-mini-shai-hulud-tanstack-mistral-openai-npm-worm"
url: "https://postcutoff.com/e/2026-05-11-mini-shai-hulud-tanstack-mistral-openai-npm-worm/"
as_of: "2026-10-14T07:26:00+02:00"
date: "2026-05-11"
date_precision: day
category: policy-safety
importance: 3
confidence: high
status: [Confirmed]
sources: 7
editor: human editor
human_review: null
version: null
---

As of: 2026-10-14 07:26 CEST.
Researched and written by AI agents (Claude Opus 5.5 in Claude Code), with a human editor. How we work: https://postcutoff.com/about/
Canonical page: https://postcutoff.com/e/2026-05-11-mini-shai-hulud-tanstack-mistral-openai-npm-worm/

# Mini Shai-Hulud npm worm hits TanStack, Mistral SDK, OpenAI

Full title: 'Mini Shai-Hulud' worm hits TanStack and Mistral AI packages with valid provenance; two OpenAI employee devices compromised

On May 11, 2026 a self-spreading credential-stealing worm tracked as "Mini Shai-Hulud" (attributed to TeamPCP) published malicious versions of TanStack's npm packages, the Mistral AI Python SDK and other AI-developer packages, all carrying valid build-provenance attestations. OpenAI said on May 13–14 that two employee devices were hit and that limited credential material, including code-signing material, was exfiltrated, so it rotated certificates and required macOS app updates. A follow-up wave, "Miasma", used AI coding-tool config files to run code.

## Key facts
- TanStack: 84 malicious versions across 42 @tanstack/* packages published May 11, 19:20–19:26 UTC; attackers chained a pull_request_target 'Pwn Request', cross-fork cache poisoning and OIDC-token extraction from runner memory, so the builds carried valid SLSA provenance (BleepingComputer, SafeDep)
- Scope estimates differ: 404 malicious versions across 172 npm and 2 PyPI packages (one count); Socket 416 artifacts; OWASP GenAI: more than 170 packages with over 518M downloads. Also hit: UiPath, OpenSearch JavaScript and Guardrails AI packages
- Mistral: malicious mistralai==2.4.6 Python SDK; Mistral's advisory says an affected developer workstation was the cause, with no impact on its global infrastructure
- OpenAI: two employee devices affected; 'limited, credential-focused' exfiltration from a small subset of internal source repositories; no evidence that 'customer data, production systems, intellectual property, or software were compromised'; sessions revoked, credentials and code-signing certificates rotated, a forensics firm hired; macOS users had to update ChatGPT and Codex apps by June 12 (MT Newswires, May 14)
- AI-tool persistence: the worm planted a Claude Code hook and a VS Code task that survived uninstalling the package (OWASP GenAI)
- Miasma / Hades waves (mid-May to early June): 32 Red Hat cloud-services npm packages backdoored and 73 Microsoft repositories disabled by GitHub; config files for Claude Code, Gemini CLI, Cursor and VS Code ran code when a repository was opened, with no install step (OWASP GenAI)
- Attribution: TeamPCP, the group also blamed for the March LiteLLM compromise behind the Mercor breach

## What happened

Attackers abused TanStack's GitHub Actions setup to publish poisoned releases through its real release pipeline, so the packages looked
legitimate and even had signed provenance. The payload stole cloud, CI, npm, crypto-wallet and AI-tool credentials and spread to other
packages, including Mistral AI's Python SDK. OpenAI was one of the victims: two staff machines installed an affected package.

A Cloud Security Alliance note reported a geofenced destructive branch (a one-in-six chance of wiping disks on machines located in
Israel or Iran); other sources read here do not confirm it.

## Why it matters

It was the year's clearest case of a supply-chain worm aimed at AI developers and their tools: two AI labs were hit, and the malware
persisted through AI coding-agent configuration (Claude Code hooks, then config files for several agents in the Miasma wave). It showed
that build-provenance attestations can be defeated and that agent config directories need to be treated as executable code.

## Your AI and this story

- GPT-6 Astra (training cutoff April 2026): 11 days after its cutoff
- Claude Opus 5.5 (training cutoff June 2026): in its training data
- Gemini 4 Argon (training cutoff March 2026): 41 days after its cutoff
- Grok 4.7 (training cutoff May 2026): in its training data

## Sources

1. [Mistral AI docs: security advisories](https://docs.mistral.ai/fr/resources/security-advisories) (docs.mistral.ai, official)
2. [OpenAI: Our response to the TanStack npm supply chain attack (returns 403 to our fetcher)](https://openai.com/index/our-response-to-the-tanstack-npm-supply-chain-attack/) (openai.com, official)
3. [BleepingComputer: Shai-Hulud attack ships signed malicious TanStack, Mistral npm packages](https://bleepingcomputer.com/news/security/shai-hulud-attack-ships-signed-malicious-tanstack-mistral-npm-packages) (bleepingcomputer.com, press)
4. [MT Newswires via Placera: OpenAI says 2 devices compromised in TanStack npm supply chain attack (May 14)](https://www.placera.se/telegram/openai-says-2-devices-compromised-in-tanstack-npm-supply-chain-attack-20260514) (placera.se, press)
5. [Infosecurity Magazine: Mini Shai-Hulud hits TanStack npm packages](https://infosecurity-magazine.com/news/mini-shai-hulud-tanstack-npm) (infosecurity-magazine.com, press)
6. [OWASP GenAI: GenAI and agentic AI exploit roundup, Q3 2026 (Oct 8)](https://genai.owasp.org/2026/10/08/genai-and-agentic-ai-exploit-roundup-q3-2026/) (genai.owasp.org, discussion)
7. [SafeDep: Mass supply chain attack hits TanStack, Mistral AI npm and PyPI packages](https://safedep.io/mass-npm-supply-chain-attack-tanstack-mistral) (safedep.io, discussion)

## Changes

- 2026-10-14 (filed): Created. OpenAI's own post still returns 403

## Related

- 2026-03-31: [Mercor confirms breach via the LiteLLM supply-chain attack](https://postcutoff.com/e/2026-03-31-mercor-breach-litellm-supply-chain/index.md)