npm and PyPI supply chain attack compromises TanStack, Mistral AI and UiPath packages

In May 2026 a coordinated software‑supply‑chain attack inserted 401 malicious releases into more than 170 open‑source packages on npm (JavaScript) and PyPI (Python) within a five‑hour window. Researchers named the campaign “Mini Shai‑Hulud” because the rapid, worm‑like spread leveraged automated CI/CD pipelines that pull the latest versions without manual review.

The breach affected major ecosystems: 42 TanStack‑related packages (including the widely used TanStack Router), SDKs from Mistral AI published to Azure and Google Cloud integrations, and 65 UiPath npm packages. Attackers aimed to harvest API keys, cloud credentials and other secrets from build environments. The threat group TeamPCP later claimed to have exfiltrated about 5 GB of data from roughly 450 private repositories.

Security experts advise developers to audit lockfiles, caches and container images, delay the automatic adoption of newly published versions for at least 24 hours, and reset any compromised credentials.