Mini Shai-Hulud is back on npm. On May 11, 84 malicious versions of 42 @tanstack/* packages were published between 19:20 and 19:26 UTC (CVE-2026-45321, CVSS 9.6 Critical). It spread from there into packages from Mistral AI, UiPath and OpenSearch, and into PyPI.
Aikido counted 373 malicious package-version entries across 169 npm package names; Socket, tracking 84 TanStack artifacts, said the real figure was likely at least double its own count. The worm steals npm, GitHub, cloud and CI/CD credentials from developer machines and runners, then republishes itself.
The dangerous part is how it published: a pull_request_target misconfiguration, GitHub Actions cache poisoning, then reading the runner's memory to lift the in-memory OIDC token. That produced malicious packages carrying valid SLSA Build Level 3 provenance — the first npm worm known to do it. Provenance verification alone will not catch this.
Researchers attribute the wave to TeamPCP, which Google tracks as UNC6780, on shared code markers and the group's own claim of credit. But the fully weaponized worm went public on GitHub on the evening of May 12, so the toolchain is now available to anyone, and later waves won't attribute so cleanly.
Order matters when cleaning up. Kill the gh-token-monitor persistence service before rotating anything — revoking tokens first triggers a dead-man's switch that wipes the home directory. Then remove the injected hooks in .claude/ and .vscode/, rotate npm, GitHub and cloud credentials, DNS-block *.getsession.org, and audit publishing logs for releases nobody triggered.
Updated August 13, 2026: The worm resurfaced on June 19 with 1,614 exfiltration repositories tied to 21 compromised GitHub accounts — identity compromise rather than a software flaw, so no CVE and nothing for a vulnerability scanner to find. Researchers attribute that wave to TeamPCP with moderate confidence.
Source: Dark Reading
