Mini Shai-Hulud tears at OSS trust

Mini Shai-Hulud, a software supply chain threat first detected in April, re-emerged on Monday, compromising more than 160 npm open-source software (OSS) packages, many of them popular and widely used with millions of weekly downloads. 

The latest outbreak comes two weeks after the first  “Mini Shai-Hulud” campaign first appeared, with compromises of widely used SAP Cloud Application Programming (CAP) and Cloud MTA Build Tool npm packages, among others, underscoring the growing threats to software supply chains.  

Here’s what the ReversingLabs (RL) threat research team knows about Mini Shai-Hulud — and some key responses your team can take.

[ Learn about Spectra Assure Community | Join for free ]

Infrastructure-level packages like TanStack compromised

The newest wave came into focus after the compromise of 84 malicious package versions tied to the widely used TanStack ecosystem. In its official post mortem, the TanStack team disclosed that attackers published malicious versions of 42 @tanstack/* packages to npm after the threat actors successfully compromised publishing credentials. The breach includes packages like @tanstack/react-router which has more than 12 million weekly downloads.

Tomislav Peričin, ReversingLabs co-founder and chief software architect, said TeamPCP, which is behind the latest attack, was targeting strategic open-source assets. 

“That's not a niche library, it's load-bearing infrastructure for huge swaths of the JavaScript ecosystem, consumed directly and transitively.”
—Tomislav Peričin

TanStack said the malicious packages included credential-stealing functionality targeting developer environments and CI systems. The compromise highlighted a now-familiar pattern in software supply chain attacks, with trusted packages weaponized to harvest tokens and secrets that can then be used to compromise additional packages and organizations. 

The attack’s scope expands — but focus stays consistent

Security researchers say the attack appears linked to the broader Mini Shai-Hulud malware campaign first observed earlier this year, with a much broader scope. The security firm “373 malicious package-version entries across 169 npm package names.”