FOSSA: Mini-Shai-Hulud Mass Compromise

What it is

FOSSA's remediation writeup on the Mini-Shai-Hulud supply-chain attack of May 11, 2026, which pushed malicious versions of at least 235 npm/PyPI packages. It started with 42 @tanstack/* packages, then spread to UiPath (65 pkgs), Mistral AI, OpenSearch, Guardrails AI, plus ~62 unscoped typosquats. FOSSA ties it to the earlier SAP CAP compromise (late April 2026) as a prior Shai-Hulud variant.

How it works

Two npm delivery paths and one PyPI path all fire at install/import time, before review or sandboxing:

flowchart TD
  A[npm install / import] --> B{delivery path}
  B -->|tanstack| C[optionalDependencies -> Git pkg<br/>prepare hook runs, exits non-zero]
  B -->|uipath/mistral| D[preinstall: node setup.mjs<br/>downloads Bun runtime]
  B -->|PyPI import| E[__init__.py dropper -> curl<br/>83.142.209.194 -> /tmp/transformers.pyz]
  C --> P[secondary payload]
  D --> P
  E --> P
  P --> X[harvest creds -> Session -> filev2.getsession.org]
  P --> Y[IDE poisoning persists past reinstall]

The prepare-hook variant deliberately exits non-zero so logs read as an inert optional-dependency failure. The PyPI dropper is staged: the sdist/wheel contain only the dropper (confirmed in mistralai 2.4.6), so static analysis sees the fetch but not the payload; sandboxes that install-but-don't-import miss it entirely. Transitive imports trigger it too.

Preconditions / Affected

• Any npm install (even a pinned single version) of an affected npm package.
• Any import mistralai or import guardrails — including transitive imports — on PyPI.
• Affected PyPI: mistralai, guardrails-ai, numpy-fast. Affected npm scopes include @tanstack/*, @uipath/*, @mistralai/*, @squawk/*, @tallyui/*, @opensearch-project/opensearch, plus ~62 unscoped typosquats.
• Credentials at risk: AWS (~/.aws/credentials, EC2 metadata), GCP/Azure, Kubernetes SA tokens, Vault (~/.vault-token), GitHub tokens (ghp_*/gho_*/ghs_*), GitHub Actions OIDC, GitLab/CircleCI CI tokens, npm tokens (~/.npmrc).

What to do

The page gives no shell commands, but concrete detections/IOCs:

• Network: block/hunt 83.142.209.194, filev2.getsession[.]org (Session-protocol exfil), and git-tanstack[.]com (secondary C2).
• Filesystem: check for /tmp/transformers.pyz and the ~2.3MB obfuscated router_init.js inside tarballs.
• Persistence: inspect and clean ~/.claude/setup.mjs, ~/.claude/router_runtime.js, ~/.vscode/tasks.json, ~/.vscode/setup.mjs — a wipe-and-reinstall of the dependency does not evict these.
• Rotate every credential class listed above if any affected package was installed/imported.

Caveats

Wiz reported on May 13 that a bug renders the payload non-functional for the @uipath/* and @mistralai/* npm packages specifically — but the PyPI mistralai package is unaffected by the bug and must be treated as fully compromised. Do not let the npm bug create false confidence about the PyPI side.