TeamPCP hackers compromised over 170 packages across major software projects on May 11, including 42 TanStack packages, 65 UiPath packages, and Mistral AI's PyPI packages.
The "Mini Shai-Hulud" attack chained three weaknesses in TanStack's GitHub Actions — ending with an OIDC token lifted straight out of runner memory — to hijack the pipeline and publish malicious packages carrying valid SLSA provenance. Tenable tracks the chain as CVE-2026-45321, CVSS 9.6. Provenance proves which pipeline built a package, not that the pipeline was behaving.
The malware steals developer credentials, API keys, cryptocurrency wallets, and cloud secrets, and spreads by using stolen tokens to publish infected versions of other packages. For the first time, its Python variant went after password managers including 1Password and Bitwarden, and it used the decentralized Session network for harder-to-disrupt exfiltration.
Check for compromised versions and audit your GitHub Actions configuration — then clean up in the right order. The malware runs a daemon that polls GitHub every minute to see whether its stolen token has been revoked, and revocation triggers a destructive wipe. Isolate and image the machine first, clear the persistence it leaves behind in .claude and .vscode, and rotate credentials after that.
Source: SecurityWeek