---
title: "Mini Shai-Hulud Is Back: npm Worm Hits over 160 Packages, including Mistral and Tanstack"
url: https://daily.dev/posts/mini-shai-hulud-is-back-npm-worm-hits-over-160-packages-including-mistral-and-tanstack-u4cygesuh
source_url: https://www.aikido.dev/blog/mini-shai-hulud-is-back-tanstack-compromised
type: article
source: "Aikido Security"
published: 2026-05-12T00:04:55.759Z
updated: 2026-05-12T00:32:24.279Z
tags: ["security", "cicd", "malware", "npm", "tanstack"]
reading_time: 12
upvotes: 0
comments: 0
language: en
---

> ## Documentation Index
> Fetch the complete documentation index at: https://daily.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Mini Shai-Hulud Is Back: npm Worm Hits over 160 Packages, including Mistral and Tanstack

**[Aikido Security](https://daily.dev/sources/aikido-security)** · 12 min read · 0 upvotes · 0 comments

## Summary

A new wave of the 'Mini Shai-Hulud' npm supply-chain attack has expanded from its earlier SAP-focused campaign to compromise 373 malicious package-version entries across 169 npm packages, including widely-used libraries from TanStack, Mistral AI, UiPath, Squawk, and others. The malware embeds obfuscated payload files (router_init.js) and adds a GitHub-hosted optional dependency with a prepare script that executes via Bun during npm install. The payload targets CI/CD environments to steal npm tokens, GitHub tokens, OIDC tokens, AWS credentials, Kubernetes service account tokens, and Vault secrets. After stealing credentials, it attempts to propagate by publishing new compromised versions of packages the victim has publish access to. Notably, the attack abuses trusted publishing (OIDC-based npm publish) so provenance records cannot be treated as proof of safety. Mitigation steps include checking lockfiles for affected package versions, searching for payload files, rotating all secrets from exposed environments, and auditing recent npm publish activity.

## Full article

daily.dev links to this article rather than hosting it. Read it at the original source: <https://www.aikido.dev/blog/mini-shai-hulud-is-back-tanstack-compromised>

## Similar posts on daily.dev

- [Mini Shai-Hulud strikes again: npm worm compromises hundreds of @antv packages](https://daily.dev/posts/mini-shai-hulud-strikes-again-npm-worm-compromises-hundreds-of-antv-packages-gsrjcznzd) · Aikido Security · 0 upvotes · 0 comments

---

Tags: [#security](https://daily.dev/tags/security), [#cicd](https://daily.dev/tags/cicd), [#malware](https://daily.dev/tags/malware), [#npm](https://daily.dev/tags/npm), [#tanstack](https://daily.dev/tags/tanstack)

[View this post on daily.dev](https://daily.dev/posts/mini-shai-hulud-is-back-npm-worm-hits-over-160-packages-including-mistral-and-tanstack-u4cygesuh)