Fresh Wave of Mini Shai-Hulud Malware Targets Developer Supply Chain

Malicious npm packages spread Mini Shai-Hulud malware, compromising developer credentials and hijacking GitHub Actions. Stay protected now!

By Content Team

May 13, 2026

ON THIS PAGE

A new campaign of Mini Shai-Hulud malware is spreading through npm packages, targeting the TanStack developer ecosystem with hundreds of compromised packages. Security researchers from Socket and Aikido discovered 373 malicious package entries across 169 npm packages, with evidence suggesting the actual number could be double that.

The worm-like malware steals developer credentials from machines and CI/CD systems, then uses those credentials to infect more packages automatically. What makes this wave particularly dangerous is its abuse of trusted publishing workflows - hijacking legitimate GitHub Actions to push Trojanized updates that appear authentic.

Attributed to the TeamPCP threat group, this evolved variant uses obfuscated JavaScript and targets build systems more aggressively than previous versions. Developers should immediately scan publishing logs, rotate credentials, and enable provenance verification to protect their projects.

Source: Dark Reading

Have questions about protecting your software?

Our escrow experts are standing by to help.

Book a free demo

Want more insights like this?