--- title: Mini Shai-Hulud Is Back: 172 npm and PyPI Packages... description: The Mini Shai-Hulud supply chain campaign has returned with its largest wave, compromising 172 unique packages across 403 malicious versions on npm and PyPI... canonical: https://daily.dev/posts/mini-shai-hulud-is-back-172-npm-and-pypi-packages-compromised-in-latest-wave-t0cyjl248 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Mini Shai-Hulud Is Back: 172 npm and PyPI Packages Compromised in Latest Wave | daily.dev og:description: The Mini Shai-Hulud supply chain campaign has returned with its largest wave, compromising 172 unique packages across 403 malicious versions on npm and PyPI... og:url: https://daily.dev/posts/mini-shai-hulud-is-back-172-npm-and-pypi-packages-compromised-in-latest-wave-t0cyjl248 og:image: https://api.daily.dev/og/posts/t0CyJL248.png og:image:alt: Mini Shai-Hulud Is Back: 172 npm and PyPI Packages Compromised in Latest Wave og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Mini Shai-Hulud Is Back: 172 npm and PyPI Packages Compromised in Latest Wave **[Security Boulevard](https://daily.dev/sources/securityboulevard)** · 2 min read · 0 upvotes · 0 comments ## Summary The Mini Shai-Hulud supply chain campaign has returned with its largest wave, compromising 172 unique packages across 403 malicious versions on npm and PyPI within a 48-hour window on May 11-12, 2026. High-profile scopes affected include @tanstack, @uipath, @mistralai, and @opensearch-project. The attack uses a preinstall hook to download a Bun runtime and run an obfuscated JavaScript credential stealer targeting SSH keys, cloud credentials (AWS, Azure, GCP, Kubernetes), npm/GitHub tokens, CI/CD environment variables, and AI tool configs. Stolen npm tokens are then used to self-propagate by publishing new compromised versions. Developers are advised to check dependencies installed during that window, rotate all credentials, pin package versions using lockfiles, and monitor for unauthorized publishes. Mend has issued three advisories covering all 172 affected packages. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Mini Shai-Hulud Strikes Again: 317 npm Packages Compromised](https://daily.dev/posts/mini-shai-hulud-strikes-again-317-npm-packages-compromised-u2ptexbxr) · Hacker News · 2 upvotes · 0 comments - [New Shai-Hulud malware wave compromises 600 npm packages](https://daily.dev/posts/new-shai-hulud-malware-wave-compromises-600-npm-packages-fc6izpxyv) · BleepingComputer · 5 upvotes · 1 comments - [Hackers have compromised dozens of popular open source packages in an ongoing supply chain attack](https://daily.dev/posts/hackers-have-compromised-dozens-of-popular-open-source-packages-in-an-ongoing-supply-chain-attack-m2qovp4td) · TechCrunch · 1 upvotes · 0 comments - [Mini Shai-Hulud Campaign Hits Red Hat Cloud Services npm Pac...](https://daily.dev/posts/mini-shai-hulud-campaign-hits-red-hat-cloud-services-npm-pac--jlxgalom3) · Socket · 0 upvotes · 0 comments - [Shai-Hulud: Here We Go Again. Mass npm Supply Chain Attack Hits the AntV Ecosystem](https://daily.dev/posts/shai-hulud-here-we-go-again-mass-npm-supply-chain-attack-hits-the-antv-ecosystem-nq51smsqn) · StepSecurity · 1 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#cyber](https://daily.dev/tags/cyber), [#python](https://daily.dev/tags/python), [#malware](https://daily.dev/tags/malware), [#npm](https://daily.dev/tags/npm) [View this post on daily.dev](https://daily.dev/posts/mini-shai-hulud-is-back-172-npm-and-pypi-packages-compromised-in-latest-wave-t0cyjl248) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Mini Shai-Hulud Is Back: 172 npm and PyPI Packages Compromised in Latest Wave","url":"https://daily.dev/posts/mini-shai-hulud-is-back-172-npm-and-pypi-packages-compromised-in-latest-wave-t0cyjl248","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/mini-shai-hulud-is-back-172-npm-and-pypi-packages-compromised-in-latest-wave-t0cyjl248"},"datePublished":"2026-05-12T07:09:15.646Z","dateModified":"2026-05-13T17:07:25.469Z","description":"The Mini Shai-Hulud supply chain campaign has returned with its largest wave, compromising 172 unique packages across 403 malicious versions on npm and PyPI...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/8fe9eeb967de205fd6743e2535f16178?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/8fe9eeb967de205fd6743e2535f16178?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Security Boulevard","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Security Boulevard","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/3613c832180040de8d85bb29f74395be","url":"https://daily.dev/sources/securityboulevard"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/mini-shai-hulud-is-back-172-npm-and-pypi-packages-compromised-in-latest-wave-t0cyjl248","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,cyber,python,malware,npm","timeRequired":"PT2M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Security Boulevard","item":"https://daily.dev/sources/securityboulevard"},{"@type":"ListItem","position":3,"name":"Mini Shai-Hulud Is Back: 172 npm and PyPI Packages Compromised in Latest Wave"}]} ```