---
title: Major Malware Attack Hits 170+ Open-Source Software Packages
description: Massive cyberattack "mini Shai-Hulud" targets popular open-source packages, stealing cloud credentials and exposing software vulnerabilities.
canonical_url: https://codekeeper.co/ticker/massive-cyberattack-on-open-source-packages
---

# Major Malware Attack Hits 170+ Open-Source Software Packages

Massive cyberattack "mini Shai-Hulud" targets popular open-source packages, stealing cloud credentials and exposing software vulnerabilities.

![Content Team](https://codekeeper.co/hubfs/_sized/Codekeeper_21_beeldmerkL-800.png)

By Content Team May 13, 2026

Share [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fmassive-cyberattack-on-open-source-packages%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fmassive-cyberattack-on-open-source-packages%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fmassive-cyberattack-on-open-source-packages%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fmassive-cyberattack-on-open-source-packages%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fmassive-cyberattack-on-open-source-packages%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fmassive-cyberattack-on-open-source-packages%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

ON THIS PAGE

### Want more insights like this?

Subscribe to our newsletter to get the latest software protection strategies delivered to your inbox.

By submitting your email, you consent to Codekeeper contacting you and agree to our [privacy policy](https://codekeeper.co/privacy-policy) .

A supply chain campaign called "mini Shai-Hulud" poisoned around 170 open-source packages on May 11 and 12, including TanStack's react-router, which has over 12 million weekly downloads. UiPath, Mistral AI and Guardrails AI packages were hit too, and this is not the first wave — earlier ones reached Trivy, Bitwarden and Checkmarx. Two-factor authentication never came into it. The attackers poisoned a GitHub Actions cache and lifted an OIDC token out of the runner's memory to mint a valid npm publish token. The malicious releases then carried genuine provenance attestations, so they showed verified badges pointing at an attacker-controlled build. The malware writes itself into Visual Studio Code and Claude Code config directories, so it outlives uninstalling the package, and it disguises stolen data as anonymous messaging traffic through the Session app. TanStack tells anyone who installed an affected version to change every connected cloud, server and developer credential. Do it in the right order: Wiz warns that the malware's gh-token-monitor daemon must be removed first, because revoking tokens while it is still running triggers destructive wiping. Then clear out .vscode and .claude, and block git-tanstack.com. **Source:** [CyberScoop](https://cyberscoop.com/mini-shai-hulud-supply-chain-malware-attack/)

Share this article [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fmassive-cyberattack-on-open-source-packages%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fmassive-cyberattack-on-open-source-packages%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fmassive-cyberattack-on-open-source-packages%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fmassive-cyberattack-on-open-source-packages%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fmassive-cyberattack-on-open-source-packages%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fmassive-cyberattack-on-open-source-packages%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

![blog_book_a_demo_cta_3x](https://codekeeper.co/hubfs/_sized/Codekeeper%202025/blog_book_a_demo_cta_3x-768x512.webp)

Have questions about protecting your software?

Our escrow experts are standing by to help.

[Book a free demo](https://codekeeper.co/book-a-demo)

YOU MAY ALSO LIKE

[Data breaches McKesson Confirms Data Breach as ShinyHunters Threatens to Leak 284 Million Records Sep 1, 2026](https://codekeeper.co/ticker/mckesson-data-breach-shinyhunters-extortion)

[Cyberattacks New Citrix NetScaler Zero-Day Hits Already-Patched Systems Oct 7, 2026](https://codekeeper.co/ticker/citrix-netscaler-zero-day-exploit-cve-2026-88779)

[Sheffield Hospitals Charity Supporters Hit in Beacon CRM Data Breach Aug 11, 2026](https://codekeeper.co/ticker/sheffield-hospitals-charity-data-breach-alert)

[Data breaches Manchester HIV Charity Hit by Data Breach Exposing Sensitive Health Information Aug 27, 2026](https://codekeeper.co/ticker/george-house-trust-data-breach-hackers)