Loading malware…
Mini Shai-Hulud is a self-propagating, credential-stealing worm associated with TeamPCP and software supply-chain attacks against developer workstations and CI/CD environments. Released publicly as a Shai-Hulud-derived variant in 2026, it spreads through compromised software packages, particularly across npm and PyPI. It uses stolen publishing credentials to distribute additional poisoned releases. Compromised GitHub Actions have also delivered its credential-stealing payloads.
The malware harvests package-registry tokens, GitHub credentials, SSH keys, environment variables, cloud credentials, Kubernetes authentication material, and HashiCorp Vault secrets. It also targets configuration files belonging to AI development tools, including Claude, Codex, Cursor, and Gemini. Its collection routines cover Linux, macOS, and Windows systems. Stolen secrets are exfiltrated to attacker-controlled infrastructure or GitHub repositories, enabling further account and package compromises.
Observed variants execute obfuscated JavaScript using the Bun runtime, with malicious package installation hooks initiating execution. Persistence includes poisoning Claude Code and Visual Studio Code configuration files so that opening affected projects launches the malware again, potentially preserving execution after the original dependency is removed. Later variants retrieve command-and-control addresses through Ethereum smart contracts and can execute remotely supplied code. Mini Shai-Hulud has been deployed in the ChainDrop campaign and attacks affecting widely used development libraries and automated build infrastructure. Its association with TeamPCP does not establish attribution of the original 2025 Shai-Hulud attacks to that group.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
4 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
The tracking identifier is CVE-2026-45321 (CVSS 9.6 per The Hacker News; advisory GHSA-g7cv-rxg3-hmpx per Snyk). | a new self-spreading Mini Shai-Hulud worm across npm and PyPI... poisoned roughly 170 npm and PyPI packages... plus a 1-in-6 disk-wipe payload on Israeli and Iranian locale hosts.
The four CVEs associated with this campaign are CVE-2026-33634, CVE-2026-48027, CVE-2026-45321, and CVE-2025-55182. | Mini Shai-Hulud was a self-replicating worm designed to spread across both npm and PyPI registries.
The four CVEs associated with this campaign are CVE-2026-33634, CVE-2026-48027, CVE-2026-45321, and CVE-2025-55182. | Mini Shai-Hulud was a self-replicating worm designed to spread across both npm and PyPI registries.
The four CVEs associated with this campaign are CVE-2026-33634, CVE-2026-48027, CVE-2026-45321, and CVE-2025-55182. | Mini Shai-Hulud was a self-replicating worm designed to spread across both npm and PyPI registries.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
In May, a related worm called Mini Shai-Hulud poisoned more than 400 package versions associated with 172 npm and PyPI packages in about five hours.
TanStack npm packages compromised: inside the Mini Shai-Hulud supply chain attack ... The TanStack attack is not an isolated incident. It is the latest wave in a series of npm supply chain attacks using the Shai-Hulud worm toolchain.
50 distinct techniques documented for this family, organized by ATT&CK tactic.
231 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
128 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A worm whose reported campaign abused AI coding-tool configuration files to maintain execution. The article discusses Mini Shai-Hulud and Miasma collectively and does not specify which configuration files each worm individually abused.
A Shai-Hulud variant mentioned as background to earlier ChainDrop compromises affecting hundreds of npm packages, including Keyv and Cacheable. It steals credentials and self-propagates through an obfuscated JavaScript payload executed using Bun.
A malware family described as continuing to use malicious workflow injection to steal credentials from CI/CD pipelines. It is mentioned for background, not identified as the payload responsible for the current GhostAction wave.
An open-source, TeamPCP-linked variant of Shai-Hulud used in supply-chain attacks. It propagates through stolen publishing credentials and can exfiltrate data to an HTTPS endpoint or, if unavailable, to public GitHub repositories.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.