Mass Supply-Chain Attack Slams npm and PyPi, Hits Mistral AI

Hackers behind a spate of supply-chain attacks targeting JavaScript and Python software repositories released an open-source version of their malware, paving the way for more automated worms carrying infections downstream.

See Also: How Organizations Are Strengthening Defenses Against Scattered Spider

Experts have urged security and development teams to introduce time-based delays or “code cooldowns” before incorporating updated packages from public repositories, to give defenders a chance to take down corrupted code before it’s sucked into applications across the internet (see: Flurry of Supply-Chain Software Library Attacks).

A malware variant called “Shai-Hulud: Here We Go Again” began infecting on Monday what’s now more than 170 different packages that collectively count nearly 180 million weekly downloads, said Ox Security. JavaScript packages hosted by npm and Python packages hosted by PyPI – the Python Package Index – have been infected by versions of the worm.

“This is the fifth wave of the Shai-Hulud malware family in eight months, and the second ‘Mini Shai-Hulud’ campaign in two weeks,” following a recent hit on four packages in the SAP developer ecosystem, said Endor Labs.

The Monday campaign infected npm packages built by TanStack, Mistral AI, OpenSearch Project, UiPath, DraftLab and others, with the worm in some cases jumping from one project to another.

TanStack said that on Monday, over a six minute period, an attacker initially infected 42 different npm packages it builds, with those attacks being detected approximately 20 minutes later by StepSecurity, which directly notified TanStack, allowing it to freeze the infected software.

StepSecurity said Mini Shai-Hulud is “a true worm” designed to “spread autonomously” by stealing credentials from one package and using them “to infect additional packages.” The worm can harvest credentials from over 100 different hardcoded paths in a package, ranging from cloud platforms such as Amazon Web Service, Google Cloud Platform, Kubernetes and Microsoft Azure, to developer tools, CI/CD pipelines, artificial intelligence tools, crypto wallets, messaging apps – including Signal, Slack and Telegram – as well as VPN configurations and shell history files.

The latest version of the worm includes a wiper and displays a warning that it will wipe the entire system should developers delete the worm’s access token. As a result, “do not revoke npm tokens before isolating the affected machine and imaging it for forensic analysis,” StepSecurity warned.

TeamPCP, a handle used by the Shai-Hulud threat actor, on Tuesday began releasing an open-source version of its worm code, using what appear to be compromised GitHub accounts, said Ox Security. The repositories include this tagline: “Shai-Hulud: Here We Go Again – Let the Carnage Continue. A Gift From TeamPCP.”

Of the two versions of the open-source worm available as of Wednesday copied into a separate repository 87 times, and the other 15 times.

How TanStack Got Hit

TeamPCP appears to carefully select its targets. “TanStack packages are widely used in modern JavaScript applications, especially routing and full-stack React tooling. A compromised package in that part of the dependency tree can land in a lot of places quickly,” said Aikido.

Security experts said the Monday hit on TanStack succeeded despite it having robust security. “The attack is notable because it succeeded against a target that did everything right on paper,” including using two-factor authentication to protect maintainer accounts, using trusted-publisher binding rather than “long-lived tokens” and “signed provenance attestations on every release,” Endor Labs said.

“The attacker used a novel technique – an orphaned commit pushed to a fork of the TanStack repository – to obtain a legitimate short-lived publish token,” Endor Labs said.

TanStack maintainer Tanner Linsley said in a Monday postmortem that “we got lucky” in part because the attacker’s techniques turned out to be noisy, and reused well-known tradecraft, which made for rapid matching of indicators of compromise. “A more careful attacker who didn’t break tests could have published silently for hours longer,” he said.

TanStack said it quickly deprecated all of the subverted versions and worked with npm security to pull the affected software from its registry. Anyone who installed an infected version should rotate all keys that the installation host would have been able to reach, it said.

Linsley pledged to work with security firms to try and detect these sorts of attacks more quickly, in-house and also detailed multiple ongoing npm ecosystem security challenges that need solutions.

Mistral AI Falls Victim

On Tuesday, French AI company Mistral reported that due to the TanStack compromise, “an automated worm associated with the attack led to compromised npm and PyPi packages versions being published” of its own software. The published versions were available to download for approximately three hours before being removed, and designed to automatically execute whenever the infected package was imported onto a Linux host.

Not all of these attacks have succeeded. Wiz said in a late Tuesday update that in the infected @mistralai/* and @uipath/* npm packages, it identified “a bug in the payload that renders the malware non-functional in those cases.”

That wasn’t the case for affected Mistral AI PyPI package, version 2.4.6, for which Microsoft’s security team on Tuesday said “the main payload is a credential stealer, but it also includes country-aware logic.” Specifically, the heavily obfuscated payload won’t launch if it detects Russian language support in the operating system. Also, if the malware detects signs that it’s being run in Israel or Iran, it has a one in six chance of executing a command to delete all files and directories from the infected system, it said.

Shai-Hulud malware first appeared in September 2025, named after the sandworms of Arrakis in the “Dune” series of books and movies.

Security researchers said further “Dune” references abound, including in the names the latest version of the worm gives to the GitHub commit branches, created to serve as dead drops for stolen data. “After infecting users, it uploads an encrypted version of the stolen credentials to the victim’s GitHub account under a new repository,” with a name drawn from the Dune universe, Ox Security said. As of Tuesday, researchers counted more than 350 such repositories.

Defensive Advice

As these attacks continue, guidance from government cybersecurity officials for defending against supply-chain attacks targeting code repositories is for developers to not automatically merge new code into their continuous integration pipeline.

“What we’re finding actually is these are detected quite quickly – detected in a matter of hours or days – and a lot of organizations don’t need to run within-minute updates,” Ollie Whitehouse, CTO of the NCSC, a part of intelligence agency GCHQ, told reporters at last month’s CyberUK conference in Scotland.

StepSecurity calls this a code “cooldown period.” Tools from it and others can be configured to block packages for hours or days – allowing time for crowdsourced reviews of whether they pass muster – before automatically moving them into the continuous integration pipeline.

Beyond implementing this type of “time-based install logic to only pull packages” that are older than a user-defined period, to better mitigate supply-chain attacks, Ox Security recommends enforcing multifactor authentication “across npm, GitHub and cloud accounts,” and to also “treat key rotation as a routine practice rather than an incident response measure.”