Mini Shai-Hulud Compromised Signed npm and PyPI Packages via GitHub Actions OIDC Abuse

A large software supply-chain campaign dubbed Mini Shai-Hulud compromised more than 170 npm packages and at least two PyPI packages tied to projects including TanStack, Mistral AI, OpenSearch, UiPath, Guardrails AI, and others. Researchers and vendors attributed the activity to TeamPCP, saying the attackers abused GitHub Actions release workflows—especially pull_request_target, cache poisoning, and theft of short-lived OIDC material from runners—to publish trojanized packages with apparently legitimate SLSA provenance, Sigstore attestations, and trusted-publishing signatures. Reports variously counted between roughly 160 and 400+ malicious package versions, with some affected packages totaling hundreds of millions of downloads, and OpenSearch and Mistral both confirmed compromised releases while TanStack described a chained workflow attack on its publishing pipeline.

The malware targeted developer workstations and CI/CD systems, stealing npm, GitHub, cloud, Kubernetes, Vault, SSH, Docker, and AI-tool credentials, then attempting worm-like propagation by republishing infected packages with stolen tokens or workflow-issued publish credentials. Investigators said the payload also established persistence through VS Code tasks, Claude Code hooks, and in some cases system services, while exfiltrating data through Session, GitHub dead drops, and other attacker infrastructure; some variants included extortion notes, dead-man-switch logic, and geofenced destructive behavior. Defenders were urged to treat hosts that installed affected versions as potentially fully compromised, remove persistence before revoking tokens where applicable, rotate all exposed secrets from clean systems, invalidate CI caches, audit lockfiles and publishing activity, and rebuild impacted environments from trusted sources.