Mini Shai-Hulud Worm Compromises TanStack, Mistral AI, Guardrails AI & More Packages

What it is

The Mini Shai-Hulud worm (attributed to TeamPCP, tracked as CVE-2026-45321, CVSS 9.6) with the specific indicators, package versions, and one operational constraint the summary omits. The summary establishes the campaign, the OIDC-minting mechanism, and the SLSA-attestation novelty — this document carries the IOCs, the root-cause misconfiguration, and the incident-response ordering rule.

Root cause you can actually fix

The TanStack compromise worked because the OIDC trusted-publisher config granted trust at the repository level rather than scoped to a specific protected branch and workflow file. An orphaned commit in a fork triggered the legitimate TanStack/router workflow surface, which was then able to request a valid short-lived npm publish token. If your trusted publishing is repo-scoped rather than branch/workflow-scoped, you have the same exposure. The propagation step also depends on finding a publishable npm token with bypass_2fa set to true.

Critical IR ordering constraint

The dead-man's switch polls api.github.com/user every 60 seconds; the malware's npm token carries the description IfYouRevokeThisTokenItWillWipeTheComputerOfTheOwner. Revoking that token from the npm dashboard triggers rm -rf ~/, turning the host into a wiper. Do not revoke the token before isolating and imaging the system. This inverts normal "revoke credentials first" response.

Indicators of compromise

• Exfil channels: filev2.getsession[.]org (Session Protocol, unlikely to be blocked in enterprises), api.masscan[.]cloud (Actions secrets), typosquat git-tanstack[.]com, and IP 83.142.209[.]194 (PyPI stealer download)
• Dead-drop repos committed under author claude@users.noreply.github.com; all attacker repos contain the string Shai-Hulud: Here We Go Again (400+ such repos)
• npm payload file: router_init.js; PyPI payload writes /tmp/transformers.pyz and runs it with python3 without integrity verification
• IDE persistence hooks in Claude Code and VS Code; a gh-token-monitor service re-exfiltrates GitHub tokens

Affected versions (confirmed)

• guardrails-ai@0.10.1 (PyPI) — executes on import, not install
• mistralai@2.4.6 (PyPI)
• @opensearch-project/opensearch@3.5.3, 3.6.2, 3.7.0, 3.8.0
• @squawk/mcp@0.9.5, @squawk/weather@0.5.10, @squawk/flightplan@0.5.6
• @tallyui/connector-medusa@1.0.1–1.0.3, @tallyui/connector-vendure@1.0.1–1.0.3
• TanStack: 42 packages, 84 versions

Delivery differs by cluster

flowchart TD
    A[Compromised package] --> B{Cluster}
    B -->|TanStack| C[JS file in tarball + optional dep to GitHub package]
    C --> D[prepare hook runs payload via Bun]
    B -->|Mistral npm| E[package.json preinstall hook]
    E --> F[node setup.mjs downloads Bun, runs same JS malware]
    B -->|PyPI| G[Download stealer from remote server]
    G --> H[Geofenced: 1-in-6 rm -rf / in Israel/Iran, skips Russian-language envs]

The TanStack cluster hides its JS payload in the tarball and pulls execution through an optional GitHub-hosted dependency's prepare hook (Bun runtime), whereas Mistral's npm packages use the older preinstall → node setup.mjs route.

Caveats

TanStack states no npm tokens were stolen and its publish workflow was not compromised — the abuse was purely OIDC-token minting from a hijacked workflow run. The PyPI variants "operate notably differently" from the npm JavaScript malware (per Wiz), so npm-focused detections won't cover the Python packages.