GoKawiilThe Mini Shai-Hulud malware campaign continues to slither its way through the software supply chain, rearing its malicious head in a fresh wave of compromised npm packages and artifacts, mainly those used throughout the open source TanStack developer ecosystem.
Researchers from Socket Threat Research and Aikido have identified hundreds of new compromised packages with the same basic goal as the previous proliferation of the worm-like malware: steal credentials from developer machines, and from continuous integration/continuous delivery (CI/CD) runners used by developers, then use those credentials to infect more packages for self-replication.
Aikido researchers identified 373 malicious package-version entries across 169 npm package names, mainly related to the TanStack open source Web application stack. Meanwhile, researchers at Socket identified 84 compromised TanStack npm package artifacts modified with Mini Shai-Hulud, they said in a blog post published Tuesday. However, there is evidence that there are at least double that amount that span multiple organizations and developer tooling ecosystems, including SAP-related packages, AI tooling, and enterprise libraries, according to Socket.
Related:'TrustFall' Convention Exposes Claude Code Execution Risk
Indeed, the campaign appears to be ongoing and moving quickly, according to researchers from both firms. However, Raphael Silva, a security researcher at Aikido, wrote in a blog post published today that what's even more important is that this time, attackers are going for potentially even more dangerous proliferation tactics than in previous attacks.
"The important part is not only the number of packages, but where they run," he wrote. "These packages are likely to be installed in local developer environments, CI jobs, release workflows, and internal build systems."
Abuse of Trust: Compromised Maintainer Accounts
Socket attributes the latest wave of infected packages to a recurring threat cluster informally tracked as TeamPCP, which operates Mini Shai-Hulud — a variant of Shai-Hulud that presumably takes its name from the "Dune" sandworm and was first seen infecting code packages in September 2025.
Attackers designed the malware to steal credentials and infect components across other software, propagating on its own without developer or attacker input. After its initial appearance, Shai-Hulud continued to surface periodically, appearing with new wiper capability in November and December campaigns of the same year.
Then Mini Shai-Hulud surfaced late last month, with more advanced and aggressive techniques that not only steal credentials and allow it to replicate, but also can hijack trusted publishing paths and execute malicious payloads during installation. It does this by compromising maintainers’ publishing credentials and automatically pushing trojanized package updates to repositories under those accounts.
... continue reading