Mini Shai-Hulud Worm Hits TanStack, Mistral AI, Guardrails AI Packages
The threat actor TeamPCP is reportedly behind a new supply chain attack campaign, dubbed Mini Shai-Hulud. The Hacker News reports that popular npm and PyPI packages from organizations including TanStack, UiPath, Mistral AI, OpenSearch, and Guardrails AI have been compromised. These packages were modified to include an obfuscated JavaScript file, ‘router_init.js’, designed to profile the execution environment.
This campaign highlights the persistent threat to the software supply chain. By compromising widely used libraries, attackers can gain a broad foothold, potentially impacting numerous downstream projects and organizations that rely on these packages. The obfuscation technique used suggests an effort to evade detection by security tools.
Defenders should prioritize auditing their dependencies for signs of compromise. Implementing robust software composition analysis (SCA) tools and maintaining strict vetting processes for third-party libraries are critical. Promptly updating packages to versions confirmed to be clean, and isolating or removing potentially compromised dependencies, are immediate mitigation steps.
What This Means For You
- If your organization uses any TanStack, UiPath, Mistral AI, OpenSearch, or Guardrails AI packages, immediately review your dependency tree. Audit your build pipelines and deployed applications for the presence of 'router_init.js' or any other suspicious files within these packages. Consider temporarily pinning to known good versions while further investigation occurs.
Related ATT&CK Techniques
🛡️ Detection Rules
3 rules · 6 SIEM formats3 detection rules auto-generated for this incident, mapped to MITRE ATT&CK. Sigma YAML is free — export to any SIEM format via the Intel Bot.
Supply Chain Compromise: Mini Shai-Hulud Worm - router_init.js
Indicators of Compromise
| ID | Type | Indicator |
|---|---|---|
| Mini-Shai-Hulud-Worm | Supply Chain Attack | Compromised npm packages from TanStack, UiPath, Mistral AI, OpenSearch, Guardrails AI |
| Mini-Shai-Hulud-Worm | Code Injection | Modified npm packages containing 'router_init.js' (obfuscated JavaScript file) |
| Mini-Shai-Hulud-Worm | Supply Chain Attack | Compromised PyPI packages from TanStack, UiPath, Mistral AI, OpenSearch, Guardrails AI |
Written by SCW Vulnerability Desk
Related coverage on
Instructure Reaches Ransom Agreement with ShinyHunters to Stop Canvas Leak
American educational technology firm Instructure, parent company of Canvas, has reportedly reached an "agreement" with the cybercrime group ShinyHunters following a breach. The Hacker News...
OpenAI Launches Daybreak for AI-Powered Vulnerability Detection
OpenAI has rolled out Daybreak, a new cybersecurity initiative leveraging its frontier AI models and Codex Security. The Hacker News reports that Daybreak aims to...
Apple iOS 26.5 Brings End-to-End Encrypted RCS Messaging
Apple has officially rolled out iOS 26.5, introducing support for end-to-end encrypted (E2EE) Rich Communication Services (RCS) messaging in beta. The Hacker News reports this...