# TanStack + @uipath mini-Shai-Hulud compromise

> On 2026-05-11 between 19:20 and 19:26 UTC, TeamPCP pushed malicious versions across `@tanstack/*`, `@uipath/*`, `@mistralai/*`, and many smaller scopes by chaining `pull_request_target`, GitHub Actions cache poisoning, and runtime OIDC-token extraction from a runner. Same Mini Shai-Hulud credential-stealer as the April SAP campaign. Final tally: 177 packages, 403 versions, >518M cumulative downloads. OpenAI confirmed two compromised employee devices and rotated platform code-signing certificates.

- Published: 2026-05-11
- Last updated: 2026-05-18
- Severity: critical
- Kind: Compromise - A legitimate, already-used package, maintainer account, CI pipeline, or release tag was hijacked and a malicious version was published under a name people already depend on.
- Ecosystems: npm, PyPI
- Scope: 179 packages, 413 compromised versions
- Tags: worm, credential-theft, ci-cd-compromise, maintainer-takeover, obfuscation
- Threat actor: TeamPCP
- Also known as: Mini Shai-Hulud, TanStack burst
- Detected by: Wiz, Socket, Mend, OX Security
- Incident ID: npm-2026-05-shai-hulud-tanstack

## Affected packages (179)

Only the exact versions listed were named by the source advisories. Other versions are not implicated.

| Package | Ecosystem | Compromised versions |
|---|---|---|
| [@beproduct/nestjs-auth](https://dependencywatch.io/package/npm/@beproduct/nestjs-auth) | npm | 0.1.2, 0.1.3, 0.1.4, 0.1.5, 0.1.6, 0.1.7, 0.1.8, 0.1.9, 0.1.10, 0.1.11, 0.1.12, 0.1.13, 0.1.14, 0.1.15, 0.1.16, 0.1.17, 0.1.18, 0.1.19 |
| [@cap-js/db-service](https://dependencywatch.io/package/npm/@cap-js/db-service) | npm | 2.10.1 |
| [@cap-js/postgres](https://dependencywatch.io/package/npm/@cap-js/postgres) | npm | 2.2.2 |
| [@cap-js/sqlite](https://dependencywatch.io/package/npm/@cap-js/sqlite) | npm | 2.2.2 |
| [@dirigible-ai/sdk](https://dependencywatch.io/package/npm/@dirigible-ai/sdk) | npm | 0.6.2, 0.6.3 |
| [@draftauth/client](https://dependencywatch.io/package/npm/@draftauth/client) | npm | 0.2.1, 0.2.2 |
| [@draftauth/core](https://dependencywatch.io/package/npm/@draftauth/core) | npm | 0.13.1, 0.13.2 |
| [@draftlab/auth](https://dependencywatch.io/package/npm/@draftlab/auth) | npm | 0.24.1, 0.24.2 |
| [@draftlab/auth-router](https://dependencywatch.io/package/npm/@draftlab/auth-router) | npm | 0.5.1, 0.5.2 |
| [@draftlab/db](https://dependencywatch.io/package/npm/@draftlab/db) | npm | 0.16.1, 0.16.2 |
| [@mesadev/rest](https://dependencywatch.io/package/npm/@mesadev/rest) | npm | 0.28.3 |
| [@mesadev/saguaro](https://dependencywatch.io/package/npm/@mesadev/saguaro) | npm | 0.4.22 |
| [@mesadev/sdk](https://dependencywatch.io/package/npm/@mesadev/sdk) | npm | 0.28.3 |
| [@mistralai/mistralai](https://dependencywatch.io/package/npm/@mistralai/mistralai) | npm | 2.2.2, 2.2.3, 2.2.4 |
| [@mistralai/mistralai-azure](https://dependencywatch.io/package/npm/@mistralai/mistralai-azure) | npm | 1.7.1, 1.7.2, 1.7.3 |
| [@mistralai/mistralai-gcp](https://dependencywatch.io/package/npm/@mistralai/mistralai-gcp) | npm | 1.7.1, 1.7.2, 1.7.3 |
| [@ml-toolkit-ts/preprocessing](https://dependencywatch.io/package/npm/@ml-toolkit-ts/preprocessing) | npm | 1.0.2, 1.0.3 |
| [@ml-toolkit-ts/xgboost](https://dependencywatch.io/package/npm/@ml-toolkit-ts/xgboost) | npm | 1.0.3, 1.0.4 |
| [@opensearch-project/opensearch](https://dependencywatch.io/package/npm/@opensearch-project/opensearch) | npm | 3.5.3, 3.6.2, 3.7.0, 3.8.0 |
| [@squawk/airport-data](https://dependencywatch.io/package/npm/@squawk/airport-data) | npm | 0.7.4, 0.7.5, 0.7.6, 0.7.7, 0.7.8 |
| [@squawk/airports](https://dependencywatch.io/package/npm/@squawk/airports) | npm | 0.6.2, 0.6.3, 0.6.4, 0.6.5, 0.6.6 |
| [@squawk/airspace](https://dependencywatch.io/package/npm/@squawk/airspace) | npm | 0.8.1, 0.8.2, 0.8.3, 0.8.4, 0.8.5 |
| [@squawk/airspace-data](https://dependencywatch.io/package/npm/@squawk/airspace-data) | npm | 0.5.3, 0.5.4, 0.5.5, 0.5.6, 0.5.7 |
| [@squawk/airway-data](https://dependencywatch.io/package/npm/@squawk/airway-data) | npm | 0.5.4, 0.5.5, 0.5.6, 0.5.7, 0.5.8 |
| [@squawk/airways](https://dependencywatch.io/package/npm/@squawk/airways) | npm | 0.4.2, 0.4.3, 0.4.4, 0.4.5, 0.4.6 |
| [@squawk/fix-data](https://dependencywatch.io/package/npm/@squawk/fix-data) | npm | 0.6.4, 0.6.5, 0.6.6, 0.6.7, 0.6.8 |
| [@squawk/fixes](https://dependencywatch.io/package/npm/@squawk/fixes) | npm | 0.3.2, 0.3.3, 0.3.4, 0.3.5, 0.3.6 |
| [@squawk/flight-math](https://dependencywatch.io/package/npm/@squawk/flight-math) | npm | 0.5.4, 0.5.5, 0.5.6, 0.5.7, 0.5.8 |
| [@squawk/flightplan](https://dependencywatch.io/package/npm/@squawk/flightplan) | npm | 0.5.2, 0.5.3, 0.5.4, 0.5.5, 0.5.6 |
| [@squawk/geo](https://dependencywatch.io/package/npm/@squawk/geo) | npm | 0.4.4, 0.4.5, 0.4.6, 0.4.7, 0.4.8 |
| [@squawk/icao-registry](https://dependencywatch.io/package/npm/@squawk/icao-registry) | npm | 0.5.2, 0.5.3, 0.5.4, 0.5.5, 0.5.6 |
| [@squawk/icao-registry-data](https://dependencywatch.io/package/npm/@squawk/icao-registry-data) | npm | 0.8.4, 0.8.5, 0.8.6, 0.8.7, 0.8.8 |
| [@squawk/mcp](https://dependencywatch.io/package/npm/@squawk/mcp) | npm | 0.9.1, 0.9.2, 0.9.3, 0.9.4, 0.9.5 |
| [@squawk/navaid-data](https://dependencywatch.io/package/npm/@squawk/navaid-data) | npm | 0.6.4, 0.6.5, 0.6.6, 0.6.7, 0.6.8 |
| [@squawk/navaids](https://dependencywatch.io/package/npm/@squawk/navaids) | npm | 0.4.2, 0.4.3, 0.4.4, 0.4.5, 0.4.6 |
| [@squawk/notams](https://dependencywatch.io/package/npm/@squawk/notams) | npm | 0.3.6, 0.3.7, 0.3.8, 0.3.9, 0.3.10 |
| [@squawk/procedure-data](https://dependencywatch.io/package/npm/@squawk/procedure-data) | npm | 0.7.3, 0.7.4, 0.7.5, 0.7.6, 0.7.7 |
| [@squawk/procedures](https://dependencywatch.io/package/npm/@squawk/procedures) | npm | 0.5.2, 0.5.3, 0.5.4, 0.5.5, 0.5.6 |
| [@squawk/types](https://dependencywatch.io/package/npm/@squawk/types) | npm | 0.8.1, 0.8.2, 0.8.3, 0.8.4, 0.8.5 |
| [@squawk/units](https://dependencywatch.io/package/npm/@squawk/units) | npm | 0.4.3, 0.4.4, 0.4.5, 0.4.6, 0.4.7 |
| [@squawk/weather](https://dependencywatch.io/package/npm/@squawk/weather) | npm | 0.5.6, 0.5.7, 0.5.8, 0.5.9, 0.5.10 |
| [@supersurkhet/cli](https://dependencywatch.io/package/npm/@supersurkhet/cli) | npm | 0.0.2, 0.0.3, 0.0.4, 0.0.5, 0.0.6, 0.0.7 |
| [@supersurkhet/sdk](https://dependencywatch.io/package/npm/@supersurkhet/sdk) | npm | 0.0.2, 0.0.3, 0.0.4, 0.0.5, 0.0.6, 0.0.7 |
| [@tallyui/components](https://dependencywatch.io/package/npm/@tallyui/components) | npm | 1.0.1, 1.0.2, 1.0.3 |
| [@tallyui/connector-medusa](https://dependencywatch.io/package/npm/@tallyui/connector-medusa) | npm | 1.0.1, 1.0.2, 1.0.3 |
| [@tallyui/connector-shopify](https://dependencywatch.io/package/npm/@tallyui/connector-shopify) | npm | 1.0.1, 1.0.2, 1.0.3 |
| [@tallyui/connector-vendure](https://dependencywatch.io/package/npm/@tallyui/connector-vendure) | npm | 1.0.1, 1.0.2, 1.0.3 |
| [@tallyui/connector-woocommerce](https://dependencywatch.io/package/npm/@tallyui/connector-woocommerce) | npm | 1.0.1, 1.0.2, 1.0.3 |
| [@tallyui/core](https://dependencywatch.io/package/npm/@tallyui/core) | npm | 0.2.1, 0.2.2, 0.2.3 |
| [@tallyui/database](https://dependencywatch.io/package/npm/@tallyui/database) | npm | 1.0.1, 1.0.2, 1.0.3 |
| [@tallyui/pos](https://dependencywatch.io/package/npm/@tallyui/pos) | npm | 0.1.1, 0.1.2, 0.1.3 |
| [@tallyui/storage-sqlite](https://dependencywatch.io/package/npm/@tallyui/storage-sqlite) | npm | 0.2.1, 0.2.2, 0.2.3 |
| [@tallyui/theme](https://dependencywatch.io/package/npm/@tallyui/theme) | npm | 0.2.1, 0.2.2, 0.2.3 |
| [@tanstack/arktype-adapter](https://dependencywatch.io/package/npm/@tanstack/arktype-adapter) | npm | 1.166.12, 1.166.15 |
| [@tanstack/eslint-plugin-router](https://dependencywatch.io/package/npm/@tanstack/eslint-plugin-router) | npm | 1.161.9, 1.161.12 |
| [@tanstack/eslint-plugin-start](https://dependencywatch.io/package/npm/@tanstack/eslint-plugin-start) | npm | 0.0.4, 0.0.7 |
| [@tanstack/history](https://dependencywatch.io/package/npm/@tanstack/history) | npm | 1.161.9, 1.161.12 |
| [@tanstack/nitro-v2-vite-plugin](https://dependencywatch.io/package/npm/@tanstack/nitro-v2-vite-plugin) | npm | 1.154.12, 1.154.15 |
| [@tanstack/react-router](https://dependencywatch.io/package/npm/@tanstack/react-router) | npm | 1.169.5, 1.169.8 |
| [@tanstack/react-router-devtools](https://dependencywatch.io/package/npm/@tanstack/react-router-devtools) | npm | 1.166.16, 1.166.19 |
| [@tanstack/react-router-ssr-query](https://dependencywatch.io/package/npm/@tanstack/react-router-ssr-query) | npm | 1.166.15, 1.166.18 |
| [@tanstack/react-start](https://dependencywatch.io/package/npm/@tanstack/react-start) | npm | 1.167.68, 1.167.71 |
| [@tanstack/react-start-client](https://dependencywatch.io/package/npm/@tanstack/react-start-client) | npm | 1.166.51, 1.166.54 |
| [@tanstack/react-start-rsc](https://dependencywatch.io/package/npm/@tanstack/react-start-rsc) | npm | 0.0.47, 0.0.50 |
| [@tanstack/react-start-server](https://dependencywatch.io/package/npm/@tanstack/react-start-server) | npm | 1.166.55, 1.166.58 |
| [@tanstack/router-cli](https://dependencywatch.io/package/npm/@tanstack/router-cli) | npm | 1.166.46, 1.166.49 |
| [@tanstack/router-core](https://dependencywatch.io/package/npm/@tanstack/router-core) | npm | 1.169.5, 1.169.8 |
| [@tanstack/router-devtools](https://dependencywatch.io/package/npm/@tanstack/router-devtools) | npm | 1.166.16, 1.166.19 |
| [@tanstack/router-devtools-core](https://dependencywatch.io/package/npm/@tanstack/router-devtools-core) | npm | 1.167.6, 1.167.9 |
| [@tanstack/router-generator](https://dependencywatch.io/package/npm/@tanstack/router-generator) | npm | 1.166.45, 1.166.48 |
| [@tanstack/router-plugin](https://dependencywatch.io/package/npm/@tanstack/router-plugin) | npm | 1.167.38, 1.167.41 |
| [@tanstack/router-ssr-query-core](https://dependencywatch.io/package/npm/@tanstack/router-ssr-query-core) | npm | 1.168.3, 1.168.6 |
| [@tanstack/router-utils](https://dependencywatch.io/package/npm/@tanstack/router-utils) | npm | 1.161.11, 1.161.14 |
| [@tanstack/router-vite-plugin](https://dependencywatch.io/package/npm/@tanstack/router-vite-plugin) | npm | 1.166.53, 1.166.56 |
| [@tanstack/solid-router](https://dependencywatch.io/package/npm/@tanstack/solid-router) | npm | 1.169.5, 1.169.8 |
| [@tanstack/solid-router-devtools](https://dependencywatch.io/package/npm/@tanstack/solid-router-devtools) | npm | 1.166.16, 1.166.19 |
| [@tanstack/solid-router-ssr-query](https://dependencywatch.io/package/npm/@tanstack/solid-router-ssr-query) | npm | 1.166.15, 1.166.18 |
| [@tanstack/solid-start](https://dependencywatch.io/package/npm/@tanstack/solid-start) | npm | 1.167.65, 1.167.68 |
| [@tanstack/solid-start-client](https://dependencywatch.io/package/npm/@tanstack/solid-start-client) | npm | 1.166.50, 1.166.53 |
| [@tanstack/solid-start-server](https://dependencywatch.io/package/npm/@tanstack/solid-start-server) | npm | 1.166.54, 1.166.57 |
| [@tanstack/start-client-core](https://dependencywatch.io/package/npm/@tanstack/start-client-core) | npm | 1.168.5, 1.168.8 |
| [@tanstack/start-fn-stubs](https://dependencywatch.io/package/npm/@tanstack/start-fn-stubs) | npm | 1.161.9, 1.161.12 |
| [@tanstack/start-plugin-core](https://dependencywatch.io/package/npm/@tanstack/start-plugin-core) | npm | 1.169.23, 1.169.26 |
| [@tanstack/start-server-core](https://dependencywatch.io/package/npm/@tanstack/start-server-core) | npm | 1.167.33, 1.167.36 |
| [@tanstack/start-static-server-functions](https://dependencywatch.io/package/npm/@tanstack/start-static-server-functions) | npm | 1.166.44, 1.166.47 |
| [@tanstack/start-storage-context](https://dependencywatch.io/package/npm/@tanstack/start-storage-context) | npm | 1.166.38, 1.166.41 |
| [@tanstack/valibot-adapter](https://dependencywatch.io/package/npm/@tanstack/valibot-adapter) | npm | 1.166.12, 1.166.15 |
| [@tanstack/virtual-file-routes](https://dependencywatch.io/package/npm/@tanstack/virtual-file-routes) | npm | 1.161.10, 1.161.13 |
| [@tanstack/vue-router](https://dependencywatch.io/package/npm/@tanstack/vue-router) | npm | 1.169.5, 1.169.8 |
| [@tanstack/vue-router-devtools](https://dependencywatch.io/package/npm/@tanstack/vue-router-devtools) | npm | 1.166.16, 1.166.19 |
| [@tanstack/vue-router-ssr-query](https://dependencywatch.io/package/npm/@tanstack/vue-router-ssr-query) | npm | 1.166.15, 1.166.18 |
| [@tanstack/vue-start](https://dependencywatch.io/package/npm/@tanstack/vue-start) | npm | 1.167.61, 1.167.64 |
| [@tanstack/vue-start-client](https://dependencywatch.io/package/npm/@tanstack/vue-start-client) | npm | 1.166.46, 1.166.49 |
| [@tanstack/vue-start-server](https://dependencywatch.io/package/npm/@tanstack/vue-start-server) | npm | 1.166.50, 1.166.53 |
| [@tanstack/zod-adapter](https://dependencywatch.io/package/npm/@tanstack/zod-adapter) | npm | 1.166.12, 1.166.15 |
| [@taskflow-corp/cli](https://dependencywatch.io/package/npm/@taskflow-corp/cli) | npm | 0.1.24, 0.1.25, 0.1.26, 0.1.27, 0.1.28, 0.1.29 |
| [@tolka/cli](https://dependencywatch.io/package/npm/@tolka/cli) | npm | 1.0.2, 1.0.3, 1.0.4, 1.0.5, 1.0.6 |
| [@uipath/access-policy-sdk](https://dependencywatch.io/package/npm/@uipath/access-policy-sdk) | npm | 0.3.1 |
| [@uipath/access-policy-tool](https://dependencywatch.io/package/npm/@uipath/access-policy-tool) | npm | 0.3.1 |
| [@uipath/admin-tool](https://dependencywatch.io/package/npm/@uipath/admin-tool) | npm | 0.1.1 |
| [@uipath/agent-sdk](https://dependencywatch.io/package/npm/@uipath/agent-sdk) | npm | 1.0.2 |
| [@uipath/agent-tool](https://dependencywatch.io/package/npm/@uipath/agent-tool) | npm | 1.0.1 |
| [@uipath/agent.sdk](https://dependencywatch.io/package/npm/@uipath/agent.sdk) | npm | 0.0.18 |
| [@uipath/aops-policy-tool](https://dependencywatch.io/package/npm/@uipath/aops-policy-tool) | npm | 0.3.1 |
| [@uipath/ap-chat](https://dependencywatch.io/package/npm/@uipath/ap-chat) | npm | 1.5.7 |
| [@uipath/api-workflow-tool](https://dependencywatch.io/package/npm/@uipath/api-workflow-tool) | npm | 1.0.1 |
| [@uipath/apollo-core](https://dependencywatch.io/package/npm/@uipath/apollo-core) | npm | 5.9.2 |
| [@uipath/apollo-react](https://dependencywatch.io/package/npm/@uipath/apollo-react) | npm | 4.24.5 |
| [@uipath/apollo-wind](https://dependencywatch.io/package/npm/@uipath/apollo-wind) | npm | 2.16.2 |
| [@uipath/auth](https://dependencywatch.io/package/npm/@uipath/auth) | npm | 1.0.1 |
| [@uipath/case-tool](https://dependencywatch.io/package/npm/@uipath/case-tool) | npm | 1.0.1 |
| [@uipath/cli](https://dependencywatch.io/package/npm/@uipath/cli) | npm | 1.0.1 |
| [@uipath/codedagent-tool](https://dependencywatch.io/package/npm/@uipath/codedagent-tool) | npm | 1.0.1 |
| [@uipath/codedagents-tool](https://dependencywatch.io/package/npm/@uipath/codedagents-tool) | npm | 0.1.12 |
| [@uipath/codedapp-tool](https://dependencywatch.io/package/npm/@uipath/codedapp-tool) | npm | 1.0.1 |
| [@uipath/common](https://dependencywatch.io/package/npm/@uipath/common) | npm | 1.0.1 |
| [@uipath/context-grounding-tool](https://dependencywatch.io/package/npm/@uipath/context-grounding-tool) | npm | 0.1.1 |
| [@uipath/data-fabric-tool](https://dependencywatch.io/package/npm/@uipath/data-fabric-tool) | npm | 1.0.2 |
| [@uipath/docsai-tool](https://dependencywatch.io/package/npm/@uipath/docsai-tool) | npm | 1.0.1 |
| [@uipath/filesystem](https://dependencywatch.io/package/npm/@uipath/filesystem) | npm | 1.0.1 |
| [@uipath/flow-tool](https://dependencywatch.io/package/npm/@uipath/flow-tool) | npm | 1.0.2 |
| [@uipath/functions-tool](https://dependencywatch.io/package/npm/@uipath/functions-tool) | npm | 1.0.1 |
| [@uipath/gov-tool](https://dependencywatch.io/package/npm/@uipath/gov-tool) | npm | 0.3.1 |
| [@uipath/identity-tool](https://dependencywatch.io/package/npm/@uipath/identity-tool) | npm | 0.1.1 |
| [@uipath/insights-sdk](https://dependencywatch.io/package/npm/@uipath/insights-sdk) | npm | 1.0.1 |
| [@uipath/insights-tool](https://dependencywatch.io/package/npm/@uipath/insights-tool) | npm | 1.0.1 |
| [@uipath/integrationservice-sdk](https://dependencywatch.io/package/npm/@uipath/integrationservice-sdk) | npm | 1.0.2 |
| [@uipath/integrationservice-tool](https://dependencywatch.io/package/npm/@uipath/integrationservice-tool) | npm | 1.0.2 |
| [@uipath/llmgw-tool](https://dependencywatch.io/package/npm/@uipath/llmgw-tool) | npm | 1.0.1 |
| [@uipath/maestro-sdk](https://dependencywatch.io/package/npm/@uipath/maestro-sdk) | npm | 1.0.1 |
| [@uipath/maestro-tool](https://dependencywatch.io/package/npm/@uipath/maestro-tool) | npm | 1.0.1 |
| [@uipath/orchestrator-tool](https://dependencywatch.io/package/npm/@uipath/orchestrator-tool) | npm | 1.0.1 |
| [@uipath/packager-tool-apiworkflow](https://dependencywatch.io/package/npm/@uipath/packager-tool-apiworkflow) | npm | 0.0.19 |
| [@uipath/packager-tool-bpmn](https://dependencywatch.io/package/npm/@uipath/packager-tool-bpmn) | npm | 0.0.9 |
| [@uipath/packager-tool-case](https://dependencywatch.io/package/npm/@uipath/packager-tool-case) | npm | 0.0.9 |
| [@uipath/packager-tool-connector](https://dependencywatch.io/package/npm/@uipath/packager-tool-connector) | npm | 0.0.19 |
| [@uipath/packager-tool-flow](https://dependencywatch.io/package/npm/@uipath/packager-tool-flow) | npm | 0.0.19 |
| [@uipath/packager-tool-functions](https://dependencywatch.io/package/npm/@uipath/packager-tool-functions) | npm | 0.1.1 |
| [@uipath/packager-tool-webapp](https://dependencywatch.io/package/npm/@uipath/packager-tool-webapp) | npm | 1.0.6 |
| [@uipath/packager-tool-workflowcompiler](https://dependencywatch.io/package/npm/@uipath/packager-tool-workflowcompiler) | npm | 0.0.16 |
| [@uipath/packager-tool-workflowcompiler-browser](https://dependencywatch.io/package/npm/@uipath/packager-tool-workflowcompiler-browser) | npm | 0.0.34 |
| [@uipath/platform-tool](https://dependencywatch.io/package/npm/@uipath/platform-tool) | npm | 1.0.1 |
| [@uipath/project-packager](https://dependencywatch.io/package/npm/@uipath/project-packager) | npm | 1.1.16 |
| [@uipath/resource-tool](https://dependencywatch.io/package/npm/@uipath/resource-tool) | npm | 1.0.1 |
| [@uipath/resourcecatalog-tool](https://dependencywatch.io/package/npm/@uipath/resourcecatalog-tool) | npm | 0.1.1 |
| [@uipath/resources-tool](https://dependencywatch.io/package/npm/@uipath/resources-tool) | npm | 0.1.11 |
| [@uipath/robot](https://dependencywatch.io/package/npm/@uipath/robot) | npm | 1.3.4 |
| [@uipath/rpa-legacy-tool](https://dependencywatch.io/package/npm/@uipath/rpa-legacy-tool) | npm | 1.0.1 |
| [@uipath/rpa-tool](https://dependencywatch.io/package/npm/@uipath/rpa-tool) | npm | 0.9.5 |
| [@uipath/solution-packager](https://dependencywatch.io/package/npm/@uipath/solution-packager) | npm | 0.0.35 |
| [@uipath/solution-tool](https://dependencywatch.io/package/npm/@uipath/solution-tool) | npm | 1.0.1 |
| [@uipath/solutionpackager-sdk](https://dependencywatch.io/package/npm/@uipath/solutionpackager-sdk) | npm | 1.0.11 |
| [@uipath/solutionpackager-tool-core](https://dependencywatch.io/package/npm/@uipath/solutionpackager-tool-core) | npm | 0.0.34 |
| [@uipath/tasks-tool](https://dependencywatch.io/package/npm/@uipath/tasks-tool) | npm | 1.0.1 |
| [@uipath/telemetry](https://dependencywatch.io/package/npm/@uipath/telemetry) | npm | 0.0.7 |
| [@uipath/test-manager-tool](https://dependencywatch.io/package/npm/@uipath/test-manager-tool) | npm | 1.0.2 |
| [@uipath/tool-workflowcompiler](https://dependencywatch.io/package/npm/@uipath/tool-workflowcompiler) | npm | 0.0.12 |
| [@uipath/traces-tool](https://dependencywatch.io/package/npm/@uipath/traces-tool) | npm | 1.0.1 |
| [@uipath/ui-widgets-multi-file-upload](https://dependencywatch.io/package/npm/@uipath/ui-widgets-multi-file-upload) | npm | 1.0.1 |
| [@uipath/uipath-python-bridge](https://dependencywatch.io/package/npm/@uipath/uipath-python-bridge) | npm | 1.0.1 |
| [@uipath/vertical-solutions-tool](https://dependencywatch.io/package/npm/@uipath/vertical-solutions-tool) | npm | 1.0.1 |
| [@uipath/vss](https://dependencywatch.io/package/npm/@uipath/vss) | npm | 0.1.6 |
| [@uipath/widget.sdk](https://dependencywatch.io/package/npm/@uipath/widget.sdk) | npm | 1.2.3 |
| [agentwork-cli](https://dependencywatch.io/package/npm/agentwork-cli) | npm | 0.1.4, 0.1.5 |
| [cmux-agent-mcp](https://dependencywatch.io/package/npm/cmux-agent-mcp) | npm | 0.1.3, 0.1.4, 0.1.5, 0.1.6, 0.1.7, 0.1.8 |
| [cross-stitch](https://dependencywatch.io/package/npm/cross-stitch) | npm | 1.1.3, 1.1.4, 1.1.5, 1.1.6, 1.1.7 |
| [git-branch-selector](https://dependencywatch.io/package/npm/git-branch-selector) | npm | 1.3.3, 1.3.4, 1.3.5, 1.3.6, 1.3.7 |
| [git-git-git](https://dependencywatch.io/package/npm/git-git-git) | npm | 1.0.8, 1.0.9, 1.0.10, 1.0.11, 1.0.12 |
| [guardrails-ai](https://dependencywatch.io/package/npm/guardrails-ai) | npm | 0.10.1 |
| [guardrails-ai](https://dependencywatch.io/package/pypi/guardrails-ai) | PyPI | 0.10.1 |
| [intercom-client](https://dependencywatch.io/package/npm/intercom-client) | npm | 7.0.4 |
| [mbt](https://dependencywatch.io/package/npm/mbt) | npm | 1.2.48 |
| [mistralai](https://dependencywatch.io/package/npm/mistralai) | npm | 2.4.6 |
| [mistralai](https://dependencywatch.io/package/pypi/mistralai) | PyPI | 2.4.6 |
| [ml-toolkit-ts](https://dependencywatch.io/package/npm/ml-toolkit-ts) | npm | 1.0.4, 1.0.5 |
| [nextmove-mcp](https://dependencywatch.io/package/npm/nextmove-mcp) | npm | 0.1.3, 0.1.4, 0.1.5, 0.1.6, 0.1.7 |
| [safe-action](https://dependencywatch.io/package/npm/safe-action) | npm | 0.8.3, 0.8.4 |
| [ts-dna](https://dependencywatch.io/package/npm/ts-dna) | npm | 3.0.1, 3.0.2, 3.0.3, 3.0.4, 3.0.5 |
| [wot-api](https://dependencywatch.io/package/npm/wot-api) | npm | 0.8.1, 0.8.2, 0.8.3, 0.8.4 |

## What happened

Between 19:20 and 19:26 UTC on 2026-05-11, TeamPCP detonated the largest Mini Shai-Hulud burst to date: 177 unique packages across `@tanstack/*`, `@uipath/*`, `@mistralai/*`, `@squawk/*`, `@tallyui/*`, `@mesadev/*`, `@cap-js/*`, and dozens of smaller scopes pushed in a six-minute window. Mend / OX Security tallied 172 packages / 403 versions / >518M cumulative downloads after re-verification on 2026-05-18; Socket's affected-packages CSV (`champjss/mini-shai-hulud-checker-20260512`) and the per-package GHSA advisories were used to drive the final list.

The entry vector was `pull_request_target` cache poisoning. The attacker submitted a benign-looking PR to a TanStack repository, which triggered a workflow that ran on a runner with the repo's OIDC trust intact. By chaining a GitHub Actions cache write with a runtime memory extraction step, the attacker pulled the OIDC token from the `Runner.Worker` process, exchanged it for an npm publish token, and then iterated through every package the compromised maintainer could push to.

The payload is the same Bun-runtime credential stealer used in the SAP / `@cap-js` April wave: ~498KB obfuscated JS, PBKDF2+SHA-256 runtime string decryption, AWS IMDSv2 + GCP metadata + Azure managed identity scraping, Kubernetes service-account token theft, and direct HashiCorp Vault reads. Stolen registry tokens fed the worm: many of the affected scopes share no maintainers with TanStack, but their tokens were within reach once an OpenAI employee's laptop was compromised.

- Wiz noted on 2026-05-13 that an initial bug in the `@uipath/*` and `@mistralai/*` payload rendered those versions non-functional; the packages were still yanked and remain in scope for lockfile audits.
- 2026-05-18 re-verification against `GHSA-g7cv-rxg3-hmpx` (the full TanStack list), the TanStack postmortem refreshed 2026-05-15, and the Mend/OX Security tallies confirmed no new affected packages versus the 177 already in the database.
- OpenAI publicly confirmed two employee devices were impacted and rotated macOS, Windows, iOS, and Android code-signing certificates.
- Same Bun stealer pattern resurfaces in the 2026-05-19 `@antv` burst and the same-day `durabletask` PyPI compromise.

The campaign also seeded the next hop: GitHub CLI credentials harvested from a Nx Console maintainer's laptop during this wave were used a week later to push the malicious `nrwl.angular-console` `18.95.0` build to the VS Code Marketplace and Open VSX.

## Impact

- CI/CD credential theft: GitHub Actions OIDC, GitLab, CircleCI
- Cloud secrets: AWS IMDSv2, GCP metadata, Azure managed identity
- Kubernetes service account token theft
- HashiCorp Vault credential extraction
- npm/registry tokens for worm propagation

## What to do

1. Pin and reinstall: remove `node_modules` and the compromised versions
2. Rotate ALL CI/CD secrets: npm tokens, GitHub OIDC trust, GitLab/CircleCI
3. Rotate cloud credentials accessible from build runners
4. Rotate Kubernetes service account tokens used in pipelines
5. Audit Vault audit logs for unexpected reads during the exposure window
6. Audit npm publish history for unexpected releases under your maintainers

## Check your own dependencies

- Check a package-lock.json against this incident: https://dependencywatch.io/check/package-lock-json
- Check a requirements.txt against this incident: https://dependencywatch.io/check/requirements-txt

The scan runs entirely in the browser; lockfile contents are never uploaded.

## References

- [Mini Shai-Hulud strikes again: TanStack and more npm packages compromised](https://www.wiz.io/blog/mini-shai-hulud-strikes-again-tanstack-more-npm-packages-compromised) - Wiz
- [GHSA-g7cv-rxg3-hmpx: TanStack supply chain advisory](https://github.com/advisories/GHSA-g7cv-rxg3-hmpx) - GitHub
- [Our response to the TanStack npm supply chain attack](https://openai.com/index/our-response-to-the-tanstack-npm-supply-chain-attack/) - OpenAI
- [TanStack npm packages compromised in ongoing Mini Shai-Hulud supply-chain attack](https://socket.dev/blog/tanstack-npm-packages-compromised-mini-shai-hulud-supply-chain-attack) - Socket

---

Canonical page: https://dependencywatch.io/incident/npm-2026-05-shai-hulud-tanstack
Markdown version: https://dependencywatch.io/incident/npm-2026-05-shai-hulud-tanstack.md
Site index for agents: https://dependencywatch.io/llms.txt
DependencyWatch.io is operated by Precursor Security (https://precursorsecurity.com).