--- title: Major Supply Chain Attack Hits TanStack, Mistral AI, and UiPath description: TeamPCP hackers exploit security flaws, compromising 170 packages and targeting password managers for data theft. Secure your systems now. canonical_url: https://codekeeper.co/ticker/teampcp-hackers-compromise-170-packages --- # Major Supply Chain Attack Hits TanStack, Mistral AI, and UiPath TeamPCP hackers exploit security flaws, compromising 170 packages and targeting password managers for data theft. Secure your systems now. ![Content Team](https://codekeeper.co/hubfs/_sized/Codekeeper_21_beeldmerkL-800.png) By Content Team May 12, 2026 Share [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fteampcp-hackers-compromise-170-packages%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fteampcp-hackers-compromise-170-packages%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fteampcp-hackers-compromise-170-packages%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fteampcp-hackers-compromise-170-packages%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fteampcp-hackers-compromise-170-packages%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fteampcp-hackers-compromise-170-packages%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg) ON THIS PAGE ### Want more insights like this? Subscribe to our newsletter to get the latest software protection strategies delivered to your inbox. By submitting your email, you consent to Codekeeper contacting you and agree to our [privacy policy](https://codekeeper.co/privacy-policy) . TeamPCP hackers compromised over 170 packages across major software projects on May 11, including 42 TanStack packages, 65 UiPath packages, and Mistral AI's PyPI packages. The "Mini Shai-Hulud" attack chained three weaknesses in TanStack's GitHub Actions — ending with an OIDC token lifted straight out of runner memory — to hijack the pipeline and publish malicious packages carrying valid SLSA provenance. Tenable tracks the chain as CVE-2026-45321, CVSS 9.6. Provenance proves which pipeline built a package, not that the pipeline was behaving. The malware steals developer credentials, API keys, cryptocurrency wallets, and cloud secrets, and spreads by using stolen tokens to publish infected versions of other packages. For the first time, its Python variant went after password managers including 1Password and Bitwarden, and it used the decentralized Session network for harder-to-disrupt exfiltration. Check for compromised versions and audit your GitHub Actions configuration — then clean up in the right order. The malware runs a daemon that polls GitHub every minute to see whether its stolen token has been revoked, and revocation triggers a destructive wipe. Isolate and image the machine first, clear the persistence it leaves behind in .claude and .vscode, and rotate credentials after that. **Source:** [SecurityWeek](https://www.securityweek.com/tanstack-mistral-ai-uipath-hit-in-fresh-supply-chain-attack/) Share this article [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fteampcp-hackers-compromise-170-packages%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fteampcp-hackers-compromise-170-packages%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fteampcp-hackers-compromise-170-packages%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fteampcp-hackers-compromise-170-packages%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fteampcp-hackers-compromise-170-packages%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fteampcp-hackers-compromise-170-packages%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg) ![blog_book_a_demo_cta_3x](https://codekeeper.co/hubfs/_sized/Codekeeper%202025/blog_book_a_demo_cta_3x-768x512.webp) Have questions about protecting your software? Our escrow experts are standing by to help. [Book a free demo](https://codekeeper.co/book-a-demo) YOU MAY ALSO LIKE [FBI Agents Fear for Their Safety After Massive Data Breach Sep 28, 2026](https://codekeeper.co/ticker/shinyhunters-fbi-data-breach-threat) [Jscrambler NPM Packages Hit by Supply Chain Attack, Downloaded Nearly 1,500 Times Before Fix Aug 12, 2026](https://codekeeper.co/ticker/jscrambler-npm-supply-chain-attack) [CISA Flags Actively Exploited Linux Kernel Vulnerability Aug 12, 2026](https://codekeeper.co/ticker/cisa-adds-cve-2022-0492-to-vulnerability-catalog) [CISA Warns of Actively Exploited SolarWinds Serv-U Vulnerability Aug 12, 2026](https://codekeeper.co/ticker/critical-serv-u-flaw-cve-2026-28318)