{"investigation":{"slug":"shai-hulud-teampcp-supply-chain-attack","entity_name":"Shai-Hulud / TeamPCP Supply Chain Attack","trust_score":0,"severity_base":null,"score_modifier":-12,"confidence":0.9,"status":"published","content_type":"investigation","summary":"Shai-Hulud is a self-replicating npm and PyPI supply chain worm attributed to the financially motivated threat group TeamPCP (also tracked as DeadCatx3, PCPcat, ShellForce, CipherForce and UNC6780). Active since September 2025, the campaign has compromised hundreds of packages across ecosystems including TanStack, Mistral AI, UiPath, SAP, AntV and Red Hat by harvesting CI/CD credentials, and directly enabled the December 2025 Trust Wallet Chrome extension hack in which approximately $8.5 million was stolen from 2,520 wallets. After TeamPCP open-sourced the worm in May 2026, derivative variants such as Miasma and Hades appeared; the payload targets 166 cryptocurrency browser extensions and local wallet files, creating direct theft risk for crypto developers and users.","sections":[{"content":"Shai-Hulud is a worm-based supply chain malware family targeting the npm and PyPI open-source package ecosystems. The campaign is attributed to TeamPCP, a financially motivated, cloud-native cybercriminal group first tracked in late 2025. TeamPCP operates under multiple reported aliases: PCPcat (their first documented campaign name), ShellForce (their data-leak publication persona), DeadCatx3 (a GitHub account hosting attacker tooling), CipherForce (their proprietary ransomware brand), and Persy_PCP. Google's Threat Intelligence Group tracks the group as UNC6780. The campaign has been corroborated by multiple independent security firms including Unit 42 (Palo Alto Networks), StepSecurity, ReversingLabs, Snyk, Wiz, Orca Security and the SANS Internet Storm Center. The group's cultural markers, branch names and repository markers drawn from Frank Herbert's Dune universe (fremen, sandworm, harkonnen, atreides, melange), are consistent across documented wave iterations, supporting unified attribution. The group has demonstrated the ability to produce malicious packages carrying valid SLSA Build Level 3 provenance attestations, a significant advance in supply chain attack sophistication. On May 12, 2026, TeamPCP open-sourced the worm under an MIT license on GitHub alongside BreachForums posts encouraging independent campaigns, enabling copycat variants including Miasma and Hades. Phoenix Security describes the cumulative scale of operations through June 2026 as approximately 600 malicious npm packages, more than 2,500 compromised GitHub repositories, and confirmed active payload execution across multiple enterprise environments. A Cloud Security Alliance research note describes TeamPCP's operation as a multi-ecosystem supply chain worm spanning npm, PyPI, Docker Hub and VS Code extension marketplaces. TeamPCP also operates an alleged ransomware partnership with the Vect Ransomware Group, announced via BreachForums (see below).","heading":"Campaign Overview and Attribution","sources":[{"url":"https://threats.wiz.io/all-actors/teampcp","name":"TeamPCP - Cloud Threat Landscape (Wiz)","type":"research","credibility":2},{"url":"https://unit42.paloaltonetworks.com/teampcp-supply-chain-attacks/","name":"Weaponizing the Protectors: TeamPCP's Multi-Stage Supply Chain Attack on Security Infrastructure (Unit 42)","type":"research","credibility":1},{"url":"https://socradar.io/blog/dark-web-profile-teampcp/","name":"Dark Web Profile: TeamPCP (SOCRadar)","type":"research","credibility":2},{"url":"https://flare.io/learn/resources/blog/teampcp-cloud-native-ransomware","name":"Threat Alert: TeamPCP, An Emerging Force in the Cloud Native and Ransomware Landscape (Flare)","type":"research","credibility":2},{"url":"https://industrialcyber.co/ransomware/vect-formalizes-breachforums-and-teampcp-alliance-to-push-model-for-industrialized-ransomware-scale-raas-operations/","name":"Vect formalizes BreachForums and TeamPCP alliance (Industrial Cyber)","type":"news_article","credibility":2},{"url":"https://orca.security/resources/blog/tanstack-npm-supply-chain-worm/","name":"TanStack and 160+ npm/PyPI Packages Compromised in Supply Chain Worm Attack (Orca Security)","type":"research","credibility":2},{"url":"https://phoenix.security/teampcp-mini-shai-hulud-npm-atool-maintainer-compromise-2026/","name":"TeamPCP / Mini Shai-Hulud npm Campaign: 600 Packages, Confirmed Active Payload (Phoenix Security)","type":"research","credibility":2},{"url":"https://www.securityweek.com/over-100-npm-pypi-packages-hit-in-new-shai-hulud-supply-chain-attacks/","name":"Over 100 NPM, PyPI Packages Hit in New Shai-Hulud Supply Chain Attacks (SecurityWeek)","type":"news_article","credibility":2},{"url":"https://labs.cloudsecurityalliance.org/research/csa-research-note-teampcp-multi-ecosystem-supply-chain-20260/","name":"TeamPCP: Multi-Ecosystem Supply Chain Worm (CSA Research Note)","type":"research","credibility":2}],"severity":"critical"},{"content":"The original Shai-Hulud worm was first detected in September 2025 and marked what security researchers described as \"the end of the nuisance era of npm attacks\" by demonstrating that self-replicating malware could automate the compromise and redistribution of legitimate packages at scale. The worm operates through malicious preinstall lifecycle hooks embedded in poisoned npm packages. Upon installation, a script named set_bun.js executes before any security checks; it downloads the Bun JavaScript runtime and runs bun_environment.js, which deploys a GitHub Actions runner masquerading under the name SHA1HULUD. The runner then uses TruffleHog to harvest stored cloud credentials, npm tokens, and GitHub personal access tokens (PATs). Stolen credentials are used to publish compromised versions of every additional package the victim account maintains, enabling exponential spread. The initial campaign ultimately led to more than 500 npm packages being compromised and credentials being harvested from upwards of 25,000 GitHub repositories. SecurityWeek likewise dates the start of Shai-Hulud activity to September 2025, predating the high-visibility May 2026 TanStack campaign. The worm's primary financial targeting focus is on developer workstations and CI/CD pipelines with access to cryptocurrency infrastructure.","heading":"Original Shai-Hulud Worm (September 2025)","sources":[{"url":"https://unit42.paloaltonetworks.com/monitoring-npm-supply-chain-attacks/","name":"The npm Threat Landscape: Attack Surface and Mitigations (Unit 42)","type":"research","credibility":1},{"url":"https://cybersecuritynews.com/shai-hulud-worm-steals-npm/","name":"Shai-Hulud Worm Steals npm, GitHub, AWS, and Kubernetes Secrets From Developers (CybersecurityNews)","type":"news_article","credibility":2},{"url":"https://www.microsoft.com/en-us/security/blog/2025/12/09/shai-hulud-2-0-guidance-for-detecting-investigating-and-defending-against-the-supply-chain-attack/","name":"Microsoft Security Blog: Shai-Hulud 2.0 Guidance (December 9, 2025)","type":"other","credibility":1},{"url":"https://www.securityweek.com/over-100-npm-pypi-packages-hit-in-new-shai-hulud-supply-chain-attacks/","name":"Over 100 NPM, PyPI Packages Hit in New Shai-Hulud Supply Chain Attacks (SecurityWeek)","type":"news_article","credibility":2}],"severity":"critical"},{"content":"A second variant, Shai-Hulud 2.0, emerged in November 2025 with substantially expanded capabilities. Malicious activity was detected between approximately November 24 and December 1, 2025; at peak activity on November 24, more than 640 additional npm packages were infected within days and more than 25,000 data-leaking GitHub repositories were created. Microsoft published formal detection and defense guidance on December 9, 2025. The 2.0 variant retained the set_bun.js preinstall hook mechanism and GitHub Actions runner impersonation (SHA1HULUD) but added improved TruffleHog-based credential harvesting and infrastructure obfuscation using Cloudflare Tunnels and typosquatted domains. Notable organizations whose developer tooling was affected during this wave included Zapier, PostHog, and Postman, among others. The campaign's operator infrastructure during this wave made use of bulletproof hosting; command-and-control domains were later identified as resolving to IP addresses associated with Stark Industries Solutions, a provider with documented ties to Russian-nexus threat actors. Microsoft did not attribute the wave to TeamPCP in its December 2025 guidance, though subsequent research by Unit 42 and StepSecurity linked the November-December wave to the same actor.","heading":"Shai-Hulud 2.0 (November-December 2025) and Microsoft Guidance","sources":[{"url":"https://www.microsoft.com/en-us/security/blog/2025/12/09/shai-hulud-2-0-guidance-for-detecting-investigating-and-defending-against-the-supply-chain-attack/","name":"Microsoft Security Blog: Shai-Hulud 2.0 - Guidance for Detecting, Investigating, and Defending Against the Supply Chain Attack","type":"other","credibility":1},{"url":"https://www.securityweek.com/shai-hulud-supply-chain-attack-led-to-8-5-million-trust-wallet-heist/","name":"SecurityWeek: Shai-Hulud Supply Chain Attack Led to $8.5 Million Trust Wallet Heist","type":"news_article","credibility":2}],"severity":"critical"},{"content":"The most significant documented financial outcome of the Shai-Hulud campaign is the compromise of the Trust Wallet Chrome browser extension version 2.68. During the Shai-Hulud 2.0 wave in November 2025, attackers obtained Trust Wallet developer GitHub secrets, including a Chrome Web Store (CWS) API key. Using this key, threat actors bypassed Trust Wallet's standard internal release process, which requires manual internal approval, and on December 24, 2025 at approximately 12:32 PM UTC published a malicious extension build (v2.68) directly to the Chrome Web Store. The malicious build inserted backdoor code that, upon every wallet unlock event, called GET_SEED_PHRASE across all configured wallets and packed the resulting mnemonic phrases into the errorMessage field of what appeared to be standard PostHog analytics telemetry. This data was transmitted to an attacker-controlled domain, api.metrics-trustwallet[.]com (the domain metrics-trustwallet.com having been registered on December 8, 2025). The attackers also redirected PostHog analytics traffic to their own infrastructure so that exfiltration appeared as routine telemetry. The active exfiltration window ran until 11:00 UTC on December 26, 2025, a period of approximately 46.5 hours. Reports differ on the size of the loss: CoinDesk's December 26, 2025 report put losses at more than $7 million, while The Hacker News, SecurityWeek and later reporting put total losses at approximately $8.5 million across 2,520 affected wallet addresses, with stolen funds traced to at least 17 attacker-controlled addresses. SlowMist's on-chain analysis identified approximately 33 BTC (approximately $3 million), approximately $3 million in Ethereum and Layer-2 assets, and approximately $431 in Solana. Attackers subsequently used multiple centralized exchanges and cross-chain bridges to move and obscure stolen funds. Trust Wallet deployed a clean version 2.69 and initiated a voluntary reimbursement process; the company reported receiving over 5,000 claims against a confirmed victim set of 2,520 wallets, indicating substantial fraudulent claim attempts. Command-and-control infrastructure resolved to IP 138.124.70.40, hosted by Stark Industries Solutions.","heading":"Trust Wallet Chrome Extension Hack (December 24-26, 2025)","sources":[{"url":"https://thehackernews.com/2025/12/trust-wallet-chrome-extension-hack.html","name":"Trust Wallet Chrome Extension Hack Drains $8.5M via Shai-Hulud Supply Chain Attack (The Hacker News)","type":"news_article","credibility":2},{"url":"https://trustwallet.com/blog/announcements/trust-wallet-browser-extension-v268-incident-community-update","name":"Trust Wallet Browser Extension v2.68 Incident: An Update to Our Community (Trust Wallet official)","type":"official","credibility":1},{"url":"https://slowmist.medium.com/christmas-heist-analysis-of-trust-wallet-browser-extension-hack-bdb35c3cc6dd","name":"Christmas Heist | Analysis of Trust Wallet Browser Extension Hack (SlowMist)","type":"research","credibility":2},{"url":"https://www.halborn.com/blog/post/explained-the-trust-wallet-hack-december-2025","name":"Explained: The Trust Wallet Hack (December 2025) (Halborn)","type":"research","credibility":2},{"url":"https://www.coindesk.com/business/2025/12/26/trust-wallet-users-lose-more-than-usd7-million-to-hacked-chrome-extension","name":"Users of Binance-owned Trust Wallet lose $7 million to hacked Chrome extension (CoinDesk)","type":"news_article","credibility":1},{"url":"https://www.securityweek.com/shai-hulud-supply-chain-attack-led-to-8-5-million-trust-wallet-heist/","name":"SecurityWeek: Shai-Hulud Supply Chain Attack Led to $8.5 Million Trust Wallet Heist","type":"news_article","credibility":2}],"severity":"critical"},{"content":"A third variant, dubbed Shai-Hulud 3.0 \"The Golden Path,\" was discovered by security researcher Charlie Eriksen on December 28, 2025, two days after the Trust Wallet exfiltration window closed. The variant was identified propagating through the malicious npm package @vietmoney/react-big-calendar@0.26.2. It retained core credential-harvesting and self-propagation mechanics from prior versions but introduced enhanced obfuscation and improved cross-platform compatibility, particularly targeting Windows environments and the Bun runtime. The dead-man's switch present in earlier variants, which triggered rm -rf ~/ upon token revocation to frustrate forensic investigation, was absent from this variant, suggesting a deliberate operational change toward sustained, lower-profile exfiltration rather than destructive denial. Repositories created by this variant use a distinct marker string: \"Goldox-T3chs: Only Happy Girl.\" At time of discovery no evidence of a broad infection campaign was found; researchers assessed it as likely representing an actor preparing tooling for future operations.","heading":"Shai-Hulud 3.0 \"The Golden Path\" (December 2025)","sources":[{"url":"https://snyk.io/blog/shai-hulud-3-0/","name":"The Holiday Whisper: Shai-Hulud 3.0 (Snyk)","type":"research","credibility":2},{"url":"https://www.kodemsecurity.com/resources/guess-whos-back-shai-hulud-3-0-the-golden-path","name":"Guess Who's Back: Shai-Hulud 3.0 The Golden Path (Kodem Security)","type":"research","credibility":2},{"url":"https://cybernews.com/security/shai-hulud-malware-3rd-variant-detected-supply-chain-threat/","name":"New Shai-Hulud 3.0 malware variant discovered (Cybernews)","type":"news_article","credibility":2}],"severity":"high"},{"content":"On April 22, 2026, TeamPCP compromised @bitwarden/cli@2026.4.0 via a backdoored Checkmarx GitHub Actions workflow (checkmarx/ast-github-action). The malicious version was available on npm between approximately 5:57 PM and 7:30 PM ET, a window of roughly 93 minutes, before Bitwarden identified and removed it. An estimated 334 downloads of the malicious version occurred. The embedded payload included the self-referential string \"Shai-Hulud: The Third Coming\" and functioned like prior Shai-Hulud variants: harvesting npm tokens, GitHub PATs, SSH keys, and CI/CD secrets, then uploading them encrypted to public GitHub repositories. Bitwarden stated that no end user vault data was accessed and that production systems were unaffected; the compromise was limited to the npm distribution mechanism for the CLI during that window. The attack also affected Checkmarx distribution channels across Docker Hub, GitHub Actions, and VS Code extensions; the broader Checkmarx breach provided the initial foothold through the poisoned GitHub Actions dependency. Phoenix Security separately documented a Trivy-to-Checkmarx-to-GitHub Actions attack vector attributed to TeamPCP. The Register also reported an npm supply chain worm attack on April 22, 2026 attributed to TeamPCP activity.","heading":"Bitwarden CLI Compromise and Checkmarx Breach (April 2026)","sources":[{"url":"https://thehackernews.com/2026/04/bitwarden-cli-compromised-in-ongoing.html","name":"Bitwarden CLI Compromised in Ongoing Checkmarx Supply Chain Campaign (The Hacker News)","type":"news_article","credibility":2},{"url":"https://www.techloy.com/bitwarden-cli-compromised-in-shai-hulud-supply-chain-attack-334-developers-exposed/","name":"Bitwarden CLI Compromised in 'Shai-Hulud' Supply Chain Attack; 334 Developers Exposed (Techloy)","type":"news_article","credibility":2},{"url":"https://www.securityweek.com/bitwarden-npm-package-hit-in-supply-chain-attack/","name":"Bitwarden NPM Package Hit in Supply Chain Attack (SecurityWeek)","type":"news_article","credibility":2},{"url":"https://socradar.io/blog/bitwarden-cli-hijacked-npm-supply-chain-teampcp/","name":"Bitwarden CLI Hijacked in npm Supply Chain Attack Linked to TeamPCP and Checkmarx Breach (SOCRadar)","type":"research","credibility":2},{"url":"https://phoenix.security/teampcp-supply-chain-attack-trivy-checkmarx-github-actions-npm-canisterworm/","name":"TeamPCP Supply Chain Attack: Trivy to Checkmarx to npm (2026) (Phoenix Security)","type":"research","credibility":2},{"url":"https://www.theregister.com/2026/04/22/another_npm_supply_chain_attack/","name":"The Register: npm supply chain attack report (April 22, 2026)","type":"news_article","credibility":2}],"severity":"high"},{"content":"On April 29, 2026, a variant designated Mini Shai-Hulud targeted the SAP Cloud Application Programming (CAP) ecosystem via four npm packages: @cap-js/sqlite, @cap-js/postgres, @cap-js/db-service, and mbt. The combined weekly download count for the four affected packages was approximately 570,000. The attack mechanism mirrored prior Shai-Hulud campaigns: malicious preinstall hooks executing credential harvesting and self-propagation payloads. This wave was documented by Unit 42 and is included in Wiz's TeamPCP campaign tracking as a precursor to the larger TanStack attack that followed twelve days later. SecurityWeek also attributes a PyTorch Lightning compromise on April 30, 2026 to the TeamPCP campaign.","heading":"Mini Shai-Hulud Wave 1: SAP Ecosystem and PyTorch Lightning (April 2026)","sources":[{"url":"https://www.darkreading.com/cloud-security/teampcp-sap-packages-mini-shai-hulud","name":"TeamPCP Hits SAP Packages With 'Mini Shai-Hulud' Attack (Dark Reading)","type":"news_article","credibility":2},{"url":"https://unit42.paloaltonetworks.com/monitoring-npm-supply-chain-attacks/","name":"The npm Threat Landscape: Attack Surface and Mitigations (Unit 42)","type":"research","credibility":1},{"url":"https://www.securityweek.com/over-100-npm-pypi-packages-hit-in-new-shai-hulud-supply-chain-attacks/","name":"Over 100 NPM, PyPI Packages Hit in New Shai-Hulud Supply Chain Attacks (SecurityWeek)","type":"news_article","credibility":2}],"severity":"high"},{"content":"The attacker's GitHub account voicproducoes (ID 269549300, email voicproducoes@gmail.com), created on March 19, 2026, was used to establish a malicious fork of TanStack/router on May 10, 2026 containing the @tanstack/setup payload (malicious commit 79ac49eedf774dd4b0cfa308722bc463cfe5885c). On May 11, 2026 between 19:20 and 19:26 UTC, TeamPCP executed a three-stage exploit chain against TanStack's GitHub Actions CI/CD pipeline. Stage one: a pull request against TanStack/router triggered a pull_request_target workflow misconfiguration (a \"pwn request\"), executing attacker-controlled fork code in the base repository's security context. Stage two: the attacker poisoned the GitHub Actions pnpm store cache using a pre-computed cache key that legitimate release workflows would subsequently restore. Stage three: when release workflows ran, the contaminated cache restored attacker-controlled binaries that extracted a GitHub Actions OIDC token from runner process memory and exchanged it for npm publishing credentials. Accounts differ on the memory-extraction technique: one description reads /proc/*/cmdline, while StepSecurity and other technical write-ups describe reading /proc/<pid>/mem. According to TanStack's own post-incident analysis, \"The attacker managed to engineer a path where our own CI pipeline stole its own publish token for them, at the exact moment it was created, by way of a cache that everyone in the chain implicitly trusted.\" No maintainer credentials were directly compromised. In six minutes the attacker published 84 malicious package versions across 42 @tanstack/* packages, including @tanstack/react-router (approximately 12.7 million weekly downloads). The 2.3 MB obfuscated payload was inserted into tarballs outside the normal build process, so compromised tarballs measured approximately 900 KB versus 190 KB for clean versions. The worm then propagated via stolen maintainer credentials to additional namespaces: @uipath (60+ packages; 66 entries per Orca Security), @squawk (87 entries), @mistralai (npm, and PyPI mistralai 2.4.6), @draftlab, guardrails-ai (PyPI 0.10.1) and others. Reports differ on how quickly the wave spread: Orca Security and related reporting state that within five hours the worm had published over 400 malicious versions across 172 distinct packages, while other reporting describes 172 unique packages and 403-404 malicious versions confirmed by the end of a 48-hour window ending May 12, 2026; Orca's May 12 disclosure listed 169 npm and 2 PyPI packages. Cumulative weekly downloads across affected packages exceeded 518 million. The campaign was reportedly rated 100/100 criticality by Aikido Security. The malicious payload (router_init.js, 2.3 MB, SHA-256 ab4fcadaec49c03278063dd269ea5eef82d24f2124a8e15d7b90f2fa8601266c) used three obfuscation layers and exfiltrated data via the Session/Oxen P2P network through filev2.getsession.org. Persistence hooks targeted .claude/settings.json (Claude Code session hooks), .vscode/tasks.json, a macOS LaunchAgent gh-token-monitor, and Linux systemd user services. Dead-drop C2 used GitHub's public commit search API with commits authored as claude@users.noreply.github.com. This wave was the first documented npm worm producing packages with valid SLSA Build Level 3 provenance attestations. CVE-2026-45321 (CVSS 9.6) was assigned to the TanStack compromise.","heading":"Mini Shai-Hulud Wave 2: TanStack, Mistral AI, UiPath (May 2026)","sources":[{"url":"https://thehackernews.com/2026/05/mini-shai-hulud-worm-compromises.html","name":"Mini Shai-Hulud Worm Compromises TanStack, Mistral AI, Guardrails AI and More Packages (The Hacker News)","type":"news_article","credibility":2},{"url":"https://www.stepsecurity.io/blog/mini-shai-hulud-is-back-a-self-spreading-supply-chain-attack-hits-the-npm-ecosystem","name":"TeamPCP's Mini Shai-Hulud Is Back: A Self-Spreading Supply Chain Attack Compromises TanStack npm Packages (StepSecurity)","type":"research","credibility":2},{"url":"https://snyk.io/blog/tanstack-npm-packages-compromised/","name":"TanStack npm Packages Hit by Mini Shai-Hulud (Snyk)","type":"research","credibility":2},{"url":"https://www.mend.io/blog/mini-shai-hulud-is-back-172-npm-and-pypi-packages-compromised-in-latest-wave/","name":"Mini Shai-Hulud Wave Hits 172 npm and PyPI Packages (Mend.io)","type":"research","credibility":2},{"url":"https://www.tenable.com/blog/mini-shai-hulud-frequently-asked-questions","name":"Mini Shai-Hulud Supply Chain Attack CVE-2026-45321 FAQ (Tenable)","type":"research","credibility":2},{"url":"https://expel.com/blog/mini-shai-hulud-cross-ecosystem-supply-chain-worm-targeting-npm-pypi/","name":"Mini Shai-Hulud: Cross-ecosystem supply chain worm targeting npm and PyPI (Expel)","type":"research","credibility":2},{"url":"https://www.reversinglabs.com/blog/mini-shai-hulud-tears-at-oss-trust","name":"Team PCP's Mini Shai-Hulud tears at open-source trust (ReversingLabs)","type":"research","credibility":2},{"url":"https://orca.security/resources/blog/tanstack-npm-supply-chain-worm/","name":"TanStack and 160+ npm/PyPI Packages Compromised in Supply Chain Worm Attack (Orca Security)","type":"research","credibility":2},{"url":"https://thehackernews.com/2026/05/tanstack-supply-chain-attack-hits-two.html","name":"TanStack Supply Chain Attack Hits Two OpenAI Employee Devices (The Hacker News)","type":"news_article","credibility":2}],"severity":"critical"},{"content":"The Mini Shai-Hulud worm is defined by its autonomous self-propagation capability. Upon installation on a victim system, malicious npm lifecycle hooks execute a multi-stage payload: the worm identifies all npm packages for which the victim holds publish rights by querying the npm registry, exchanges stolen GitHub OIDC tokens for per-package publish credentials, and autonomously publishes infected versions of each identified package. This cascade converts each new victim into an unwitting amplifier of the attack. The provenance bypass is technically significant: compromised packages carry valid SLSA Build Level 3 provenance attestations generated via GitHub's OIDC token infrastructure, meaning standard supply chain verification checks pass on malicious packages. Orca Security noted that \"provenance alone is not a reliable safety signal for this attack,\" and StepSecurity observed that \"valid SLSA provenance confirms which pipeline produced the artifact, not whether the pipeline was behaving as intended.\" The worm includes a FIRESCALE fallback mechanism that searches GitHub commit messages for alternative C2 server URLs, verified against an embedded RSA key, providing resilience against infrastructure takedown.","heading":"Self-Propagation and SLSA Provenance Bypass","sources":[{"url":"https://orca.security/resources/blog/tanstack-npm-supply-chain-worm/","name":"TanStack and 160+ npm/PyPI Packages Compromised in Supply Chain Worm Attack (Orca Security)","type":"research","credibility":2},{"url":"https://www.stepsecurity.io/blog/mini-shai-hulud-is-back-a-self-spreading-supply-chain-attack-hits-the-npm-ecosystem","name":"TeamPCP's Mini Shai-Hulud Is Back: A Self-Spreading Supply Chain Attack Compromises TanStack npm Packages (StepSecurity)","type":"research","credibility":2}],"severity":"critical"},{"content":"Two OpenAI corporate employee devices were confirmed compromised during the TanStack campaign, with attackers gaining unauthorized access and conducting credential-focused exfiltration activity against internal source code repositories. OpenAI stated that \"no user data, production systems, or intellectual property were compromised or modified,\" and that only limited credential material was extracted. In response, OpenAI revoked code-signing certificates for its iOS, macOS, and Windows products and issued new certificates. Affected applications requiring update before June 12, 2026, the date the old certificates were to be revoked, included ChatGPT Desktop, Codex App, Codex CLI, and Atlas. Separately, a GitHub employee installed a trojanized VS Code extension (Nx Console, a verified publisher extension with 2.2 million installs) on May 18, 2026; the malicious version was live for approximately 11 minutes, during which TeamPCP allegedly exfiltrated approximately 3,800 GitHub internal repositories.","heading":"Downstream Compromises: OpenAI and GitHub","sources":[{"url":"https://openai.com/index/our-response-to-the-tanstack-npm-supply-chain-attack/","name":"Our Response to the TanStack npm Supply Chain Attack (OpenAI)","type":"official","credibility":1},{"url":"https://thehackernews.com/2026/05/tanstack-supply-chain-attack-hits-two.html","name":"TanStack Supply Chain Attack Hits Two OpenAI Employee Devices (The Hacker News)","type":"news_article","credibility":2},{"url":"https://phoenix.security/vs-code-extension-malware-github-breach-teampcp-2026/","name":"GitHub Internal Repository Breach via Poisoned VS Code Extension (May 2026) (Phoenix Security)","type":"research","credibility":2}],"severity":"critical"},{"content":"TeamPCP published the complete Shai-Hulud source code to GitHub under an MIT License with the message: \"Shai-Hulud: Open Sourcing The Carnage. Is it vibe coded? Yes. Does it work? Let results speak. - Love, TeamPCP.\" Reports date the release to May 12, 2026 (Orca Security) or May 12-13, 2026 (The Register and others). The release was accompanied by BreachForums posts encouraging independent campaigns. The repository included instructions directing potential adopters to \"Change keys and C2 as needed.\" The framework is a modular TypeScript/Bun toolkit implementing credential harvesting, supply chain poisoning, and encrypted exfiltration targeting CI/CD pipelines and developer workstations. Two repositories were published; they remained online for at least 12 hours before GitHub moderation intervened. Forks grew rapidly: one repository accrued 31 forks within hours of publication. OX Security confirmed copycat npm packages from independent threat actors deploying Shai-Hulud clones within days of the release. One GitHub account (agwagwagwa) submitted a pull request to the malware repository adding FreeBSD support. Researchers at Mondoo and Datadog published static analysis of the open-sourced framework. Analysts assess the open-sourcing as a deliberate \"capability diffusion\" move designed to multiply independent deployers beyond TeamPCP's own operations, complicating attribution of future waves; researchers have drawn a parallel to the 2016 Mirai botnet source code release, which spawned derivative campaigns that outlasted and outnumbered the original actor's operations.","heading":"Open-Sourcing of the Shai-Hulud Worm (May 2026)","sources":[{"url":"https://www.theregister.com/security/2026/05/13/malware-crew-teampcp-open-sources-its-shai-hulud-worm-on-github/5239319","name":"Malware crew TeamPCP open-sources its Shai-Hulud worm on GitHub (The Register)","type":"news_article","credibility":1},{"url":"https://www.ox.security/blog/shai-hulud-open-source-malware-github/","name":"Shai-Hulud Goes Open Source: Malware Creators Leak Their Own Code to GitHub (OX Security)","type":"research","credibility":2},{"url":"https://securitylabs.datadoghq.com/articles/shai-hulud-open-source-framework-static-analysis/","name":"Shai-Hulud Goes Open Source (Datadog Security Labs)","type":"research","credibility":2},{"url":"https://mondoo.com/blog/shai-hulud-clones-arrive-when-worm-source-code-goes-open-source","name":"When Worm Source Code Goes Open Source: The Shai-Hulud Clones Arrive (Mondoo)","type":"research","credibility":2},{"url":"https://orca.security/resources/blog/tanstack-npm-supply-chain-worm/","name":"TanStack and 160+ npm/PyPI Packages Compromised in Supply Chain Worm Attack (Orca Security)","type":"research","credibility":2},{"url":"https://www.securityweek.com/over-100-npm-pypi-packages-hit-in-new-shai-hulud-supply-chain-attacks/","name":"Over 100 NPM, PyPI Packages Hit in New Shai-Hulud Supply Chain Attacks (SecurityWeek)","type":"news_article","credibility":2}],"severity":"critical"},{"content":"On May 19, 2026, a compromised maintainer account was used to publish 639 malicious package versions across 323 packages in approximately 22 minutes, the largest single-hour package count of any documented Shai-Hulud wave, representing approximately 16 million combined weekly downloads. Snyk and Wiz describe the account as an @antv maintainer account; Phoenix Security describes it as the atool maintainer account, whose compromise affected popular packages including AntV, jest-canvas-mock, and echarts-for-react. The attack used the same automated credential-exploitation and bulk-publishing pipeline as prior waves. C2 infrastructure for this wave was reported at t.m-kosche.com.","heading":"Mini Shai-Hulud Wave 3: AntV / atool Maintainer Compromise (May 2026)","sources":[{"url":"https://snyk.io/blog/mini-shai-hulud-antv-npm-supply-chain-attack/","name":"Mini Shai-Hulud Hits AntV: 300+ Malicious npm Packages Published via Compromised Maintainer Account (Snyk)","type":"research","credibility":2},{"url":"https://www.wiz.io/blog/mini-shai-hulud-teampcp-hits-antv-supply-chain","name":"The Worm That Keeps on Digging: TeamPCP Hits @antv in Latest Wave (Wiz Blog)","type":"research","credibility":2},{"url":"https://phoenix.security/teampcp-mini-shai-hulud-npm-atool-maintainer-compromise-2026/","name":"TeamPCP / Mini Shai-Hulud npm Campaign: 600 Packages, Confirmed Active Payload (Phoenix Security)","type":"research","credibility":2}],"severity":"critical"},{"content":"Following the open-sourcing, a derivative campaign named Miasma targeted Red Hat Cloud Services npm packages. On June 1, 2026, a compromised Red Hat employee GitHub account was used to inject malicious orphan commits into RedHatInsights repositories, bypassing code review. Two attack waves occurred: the first at 10:53 UTC targeting the frontend-components, javascript-clients, and platform-frontend-ai-toolkit repositories, and the second at 13:44-13:46 UTC. The attack abused GitHub Actions trusted publishing, requesting short-lived OIDC tokens via id-token: write permissions, to publish 96 malicious versions across 32 packages in the @redhat-cloud-services namespace. Reports differ on the reach of the affected packages: one account gives a combined weekly download count of 116,991, while The Register's headline describes the affected package versions as downloaded 80K times a week. Notable compromised packages included frontend-components (versions 7.7.2, 7.7.3, 7.7.5) and compliance-client (versions 4.0.3, 4.0.4, 4.0.6). The Miasma payload, at 4.2 MB, features four-layer obfuscation, Bun-as-runtime execution, and AES-GCM payload staging through /tmp, and is encrypted uniquely per infection, defeating hash-based indicators of compromise. The variant replaced Dune references with Greek mythology references, and repository descriptions read \"Miasma: The Spreading Blight.\" It targets 13 AI coding tools for SessionStart hook injection, including Claude Code, GitHub Copilot, and Gemini CLI. Unit 42 and SANS ISC assessed Miasma as a Shai-Hulud derivative. Researchers at Wiz, Aikido Security, and Upwind noted tradecraft parallels with TeamPCP but cautioned that the open-sourced code enabled copycat actors, making direct attribution to TeamPCP uncertain for this variant.","heading":"Red Hat Miasma Variant (June 2026)","sources":[{"url":"https://thehackernews.com/2026/06/miasma-supply-chain-attack-compromises.html","name":"Miasma Supply Chain Attack Compromises Red Hat npm Packages (The Hacker News)","type":"news_article","credibility":2},{"url":"https://www.wiz.io/blog/miasma-supply-chain-attack-targeting-redhat-npm-packages","name":"Miasma: Supply Chain Attack Targeting Red Hat npm Packages (Wiz)","type":"research","credibility":2},{"url":"https://www.aikido.dev/blog/red-hat-npm-packages-compromised-credential-stealing-worm","name":"Red Hat npm Packages Compromised to Spread a Credential-Stealing Worm (Aikido Security)","type":"research","credibility":2},{"url":"https://www.theregister.com/security/2026/06/01/shai-hulud-malware-infects-red-hat-npm-packages-downloaded-80k-times-weekly/5249803","name":"Shai-Hulud malware worms Red Hat npm package versions downloaded 80K times a week (The Register)","type":"news_article","credibility":2},{"url":"https://phoenix.security/miasma-redhat-cloud-services-npm-supply-chain-shai-hulud-variant/","name":"Miasma NPM Supply Chain Attack: Red Hat Cloud Services npm Packages (Phoenix Security)","type":"research","credibility":2},{"url":"https://www.upwind.io/feed/miasma-npm-supply-chain-worm-redhat-credential-harvest","name":"Miasma: A Worming npm Supply Chain Attack on Red Hat Cloud Services (Upwind)","type":"research","credibility":2},{"url":"https://unit42.paloaltonetworks.com/monitoring-npm-supply-chain-attacks/","name":"The npm Threat Landscape: Attack Surface and Mitigations (Unit 42)","type":"research","credibility":1}],"severity":"critical"},{"content":"Concurrent with the npm-focused Miasma campaign, a PyPI variant named Hades emerged, characterized by the string \"Hades - The End for the Damned.\" Hades uses *-setup.pth files to execute at Python startup and fetches the Bun JavaScript runtime to execute malicious code. An initial wave targeted 19 packages; a second wave on June 8, 2026 compromised at least 29 additional packages, targeting bioinformatics, graph machine learning, and Model Context Protocol (MCP)-themed packages. Cumulatively, by June 5, 2026, at least 57 npm packages and more than 300 malicious versions had been identified under the Miasma/Hades umbrella, and total malicious artifacts across all ecosystems exceeded 471. Unit 42's npm Threat Landscape tracker listed the campaign as an ongoing, active threat as of June 2, 2026.","heading":"Hades PyPI Variant and Cumulative Ecosystem Impact","sources":[{"url":"https://www.securityweek.com/over-100-npm-pypi-packages-hit-in-new-shai-hulud-supply-chain-attacks/","name":"Over 100 NPM, PyPI Packages Hit in New Shai-Hulud Supply Chain Attacks (SecurityWeek)","type":"news_article","credibility":2},{"url":"https://unit42.paloaltonetworks.com/monitoring-npm-supply-chain-attacks/","name":"The npm Threat Landscape: Attack Surface and Mitigations (Unit 42)","type":"research","credibility":1},{"url":"https://labs.cloudsecurityalliance.org/research/csa-research-note-teampcp-multi-ecosystem-supply-chain-20260/","name":"TeamPCP: Multi-Ecosystem Supply Chain Worm (CSA Research Note)","type":"research","credibility":2},{"url":"https://blog.gitguardian.com/three-supply-chain-campaigns-hit-npm-pypi-and-docker-hub-in-48-hours/","name":"No Off Season: Three Supply Chain Campaigns Hit npm, PyPI, and Docker Hub in 48 Hours (GitGuardian)","type":"research","credibility":2}],"severity":"high"},{"content":"On June 17, 2026, 141 npm packages across the Mastra AI framework ecosystem were compromised in a 45-minute window. Mastra is an open-source TypeScript framework for building AI agents, workflows, and RAG pipelines, with approximately 8 million weekly downloads across the affected packages. The attack involved compromising the 'ehindero' npm maintainer account, which held publishing rights across the Mastra ecosystem. Attackers pre-positioned a typosquat package named easy-day-js, mimicking the legitimate dayjs date library, published under a separate account ('sergey2016') before the main attack. The easy-day-js dependency was then injected into the 141 packages so that its latest version would install automatically. An obfuscated postinstall dropper fetched a second-stage payload from attacker servers, wrote it to the temp directory, executed it as a detached hidden background process, and deleted itself to hinder forensics. The payload targets Windows, macOS, and Linux systems and targets cryptocurrency browser extensions. Microsoft's Defender Security Research Team and Threat Intelligence attributed this attack, in a blog post published June 17, 2026, to Sapphire Sleet, a North Korean state-sponsored group also known as BlueNoroff, CageyChameleon, Copernicium, and Stardust Chollima, which had previously been blamed for the Axios npm supply chain attack in April 2026. Public reporting has not established a relationship between Sapphire Sleet's Mastra campaign and TeamPCP's Mini Shai-Hulud worm; it may represent independent exploitation of the open-sourced tooling or a separate, temporally overlapping campaign.","heading":"Related Campaign: Mastra AI Compromise Attributed to North Korea (June 2026)","sources":[{"url":"https://www.securityweek.com/north-korean-hackers-blamed-for-mastra-npm-supply-chain-attack/","name":"North Korean Hackers Blamed for Mastra NPM Supply Chain Attack (SecurityWeek)","type":"news_article","credibility":2},{"url":"https://www.microsoft.com/en-us/security/blog/2026/06/17/postinstall-payload-inside-mastra-npm-supply-chain-compromise/","name":"From package to postinstall payload: Inside the Mastra npm supply chain compromise by Sapphire Sleet (Microsoft Security Blog)","type":"research","credibility":1},{"url":"https://www.bleepingcomputer.com/news/security/microsoft-links-mastra-ai-supply-chain-attack-to-north-korean-hackers/","name":"Microsoft links Mastra AI supply chain attack to North Korean hackers (BleepingComputer)","type":"news_article","credibility":2},{"url":"https://www.aikido.dev/blog/over-140-popular-mastra-npm-packages-hit-by-supply-chain-attack","name":"Over 140 popular Mastra npm Packages Hit by Supply Chain Attack (Aikido Security)","type":"research","credibility":2},{"url":"https://www.infosecurity-magazine.com/news/mastra-ai-supply-chain-attack/","name":"Microsoft Attributes Mastra AI Supply Chain Attack to North Korea (Infosecurity Magazine)","type":"news_article","credibility":2},{"url":"https://gbhackers.com/sapphire-sleet-hijacks-npm/","name":"Sapphire Sleet Hijacks npm Maintainer Account to Publish Poisoned Mastra Packages (GBHackers)","type":"news_article","credibility":2}],"severity":"critical"},{"content":"TeamPCP has operated a formal partnership with the Vect Ransomware Group, announced publicly on BreachForums and reported by Dataminr and Industrial Cyber on approximately April 16, 2026. Under this model, TeamPCP provides initial access via compromised supply chain packages and harvested credentials; Vect provides encryption and extortion tooling; BreachForums serves as operational infrastructure for affiliate management, escrow, and key distribution. VECT 2.0 ransomware was separately documented as containing a bug that unintentionally destroys files larger than 128 KB, rendering ransom payment ineffective for enterprise victims. The SANS Internet Storm Center and others reported that Databricks was investigating an alleged security compromise linked to TeamPCP credential harvesting as of late March-April 2026. An approximately 3 GB AstraZeneca data breach was alleged by LAPSUS$ to stem from TeamPCP-harvested credentials; AstraZeneca had not confirmed this claim at time of reporting. TeamPCP has also operated in extortion mode: the group threatened to release 5 GB of Mistral AI source code unless paid $25,000 in Monero, and announced a supply chain attack contest offering $1,000 in Monero for compromising open-source packages. Its use of Monero, a privacy coin, for financial demands is consistent with an effort to avoid blockchain traceability. These enterprise victim claims remain alleged pending official confirmation.","heading":"Ransomware Partnership, Extortion and Enterprise Victim Claims","sources":[{"url":"https://isc.sans.edu/diary/32846","name":"TeamPCP Supply Chain Campaign: Update 004 - Databricks Investigating Alleged Compromise (SANS ISC)","type":"research","credibility":2},{"url":"https://industrialcyber.co/ransomware/vect-formalizes-breachforums-and-teampcp-alliance-to-push-model-for-industrialized-ransomware-scale-raas-operations/","name":"Vect formalizes BreachForums and TeamPCP alliance (Industrial Cyber)","type":"news_article","credibility":2},{"url":"https://www.dataminr.com/resources/intel-brief/vect-breachforums-teampcp-converge-in-unprecedented-affiliate-mobilizatio/","name":"Cyber Intel Brief: Vect, BreachForums, and TeamPCP Converge (Dataminr)","type":"research","credibility":2},{"url":"https://www.theregister.com/2026/04/28/dont_pay_vect_a_ransom/","name":"Don't pay VECT a ransom - your big files are likely gone (The Register)","type":"news_article","credibility":1},{"url":"https://labs.cloudsecurityalliance.org/research/csa-research-note-vect2-ransomware-wiper-unrecoverable-20260/","name":"VECT 2.0: Paying the Ransom Cannot Recover Enterprise Data (Cloud Security Alliance Labs)","type":"research","credibility":2},{"url":"https://www.securityweek.com/over-100-npm-pypi-packages-hit-in-new-shai-hulud-supply-chain-attacks/","name":"Over 100 NPM, PyPI Packages Hit in New Shai-Hulud Supply Chain Attacks (SecurityWeek)","type":"news_article","credibility":2},{"url":"https://orca.security/resources/blog/tanstack-npm-supply-chain-worm/","name":"TanStack and 160+ npm/PyPI Packages Compromised in Supply Chain Worm Attack (Orca Security)","type":"research","credibility":2}],"severity":"critical"},{"content":"The Trust Wallet Chrome extension compromise demonstrates that a primary monetization vector for Shai-Hulud credential harvests is cryptocurrency theft. The C2 infrastructure used in the Trust Wallet wave (metrics-trustwallet[.]com, api.metrics-trustwallet[.]com) was tailored to impersonate a cryptocurrency wallet's analytics infrastructure, suggesting premeditated targeting of the Trust Wallet developer environment. SlowMist's on-chain analysis traced stolen assets through cross-chain bridges and centralized exchanges, consistent with professional money-laundering tradecraft. The Mini Shai-Hulud payload's second-stage cross-platform RAT targets 166 cryptocurrency-related browser extensions, with named targets including MetaMask and Phantom. The malware also harvests local wallet files for Solana, Ethereum, Bitcoin and Monero, files associated with the Exodus, Atomic Wallet and Electrum applications. Any developer who installs a compromised package on a machine used for crypto activity is therefore a direct theft target, not merely a credential exfiltration target. The Mastra campaign attributed to Sapphire Sleet also targets cryptocurrency browser extensions. No law enforcement actions or asset freezes have been publicly confirmed in the sources reviewed. The open-sourcing of the worm in May 2026 materially expands the population of actors capable of targeting cryptocurrency infrastructure via developer supply chain compromise.","heading":"Cryptocurrency and Wallet Targeting","sources":[{"url":"https://slowmist.medium.com/christmas-heist-analysis-of-trust-wallet-browser-extension-hack-bdb35c3cc6dd","name":"Christmas Heist | Analysis of Trust Wallet Browser Extension Hack (SlowMist)","type":"research","credibility":2},{"url":"https://www.how2shout.com/news/trust-wallet-chrome-extension-hack-8-5-million-stolen-v2-68-2025.html","name":"Trust Wallet Chrome Extension Hack: $8.5 Million Stolen via v2.68 (H2S Media)","type":"news_article","credibility":3},{"url":"https://orca.security/resources/blog/tanstack-npm-supply-chain-worm/","name":"TanStack and 160+ npm/PyPI Packages Compromised in Supply Chain Worm Attack (Orca Security)","type":"research","credibility":2},{"url":"https://thehackernews.com/2026/05/tanstack-supply-chain-attack-hits-two.html","name":"TanStack Supply Chain Attack Hits Two OpenAI Employee Devices (The Hacker News)","type":"news_article","credibility":2},{"url":"https://www.securityweek.com/north-korean-hackers-blamed-for-mastra-npm-supply-chain-attack/","name":"North Korean Hackers Blamed for Mastra NPM Supply Chain Attack (SecurityWeek)","type":"news_article","credibility":2}],"severity":"critical"},{"content":"The Mini Shai-Hulud payload uses a Python script that reads GitHub Actions Runner.Worker process memory via /proc/*/mem to extract all secrets, including secrets masked in CI logs that are never written to disk. Over 100 hardcoded file paths are targeted, covering cloud credentials (AWS IMDS/ECS metadata, Azure, GCP, Kubernetes service account tokens, HashiCorp Vault tokens); development tool credentials (npm tokens, PyPI credentials, Docker credentials, Git configuration, SSH keys, GPG keys); AI tool configurations (Claude Code settings, Kiro configurations, LLM API keys); cryptocurrency wallets; messaging applications; and VPN configurations. A persistent daemon named gh-token-monitor is installed when a valid GitHub token with repository write access and organization membership is detected. It persists via a macOS LaunchAgent plist at ~/Library/LaunchAgents/com.user.gh-token-monitor.plist or a Linux systemd user service at ~/.config/systemd/user/gh-token-monitor.service and polls GitHub every 60 seconds for token status. Upon token revocation the daemon executes rm -rf ~/, wiping the user's home directory; this DEADMAN_SWITCH means the daemon must be located and removed before any credential rotation. Additional persistence mechanisms include Claude Code SessionStart hooks (injecting a payload at .claude/router_runtime.js), VS Code task triggers on folder open (via .vscode/setup.mjs), and injected GitHub Actions workflows that exfiltrate secrets on subsequent CI runs; these payload files survive package uninstallation. Exfiltration uses three channels: the Session Protocol CDN (filev2.getsession.org) with RSA-4096-OAEP-wrapped AES-256-GCM encryption; GitHub GraphQL API dead-drops with commits authored as claude@users.noreply.github.com and Dune-themed branch names; and the typosquat domain git-tanstack.com.","heading":"Credential Harvesting, Persistence and Dead-Man's Switch","sources":[{"url":"https://www.stepsecurity.io/blog/mini-shai-hulud-is-back-a-self-spreading-supply-chain-attack-hits-the-npm-ecosystem","name":"TeamPCP's Mini Shai-Hulud Is Back: A Self-Spreading Supply Chain Attack Compromises TanStack npm Packages (StepSecurity)","type":"research","credibility":2},{"url":"https://orca.security/resources/blog/tanstack-npm-supply-chain-worm/","name":"TanStack and 160+ npm/PyPI Packages Compromised in Supply Chain Worm Attack (Orca Security)","type":"research","credibility":2},{"url":"https://www.deepwatch.com/labs/ca-26-018-miasma-mini-shai-hulud-compromise-of-red-hat-npm-packages/","name":"CA-26-018: Miasma/Mini Shai-Hulud Compromise of Red Hat npm Packages (Deepwatch)","type":"research","credibility":2},{"url":"https://snyk.io/blog/tanstack-npm-packages-compromised/","name":"TanStack npm Packages Hit by Mini Shai-Hulud (Snyk)","type":"research","credibility":2}],"severity":"critical"},{"content":"Across documented waves, the Shai-Hulud family employs a consistent multi-stage architecture. Initial compromise occurs via one or more of: (1) malicious npm packages with preinstall hooks executing set_bun.js; (2) GitHub Actions workflow poisoning via pull_request_target misconfiguration (pwn request); (3) GitHub Actions cache poisoning using pre-computed cache keys. The Bun JavaScript runtime is deployed as a stealth execution layer, avoiding Node.js introspection. GitHub Actions runners are impersonated under the SHA1HULUD persona to exfiltrate data, and TruffleHog is used to enumerate and extract secrets from CI/CD runner environments. Stolen npm tokens with 2FA bypass capability are used for bulk malicious package publication. The May 2026 waves added OIDC token extraction from runner memory via /proc/{pid}/mem, expanding the attack surface to organizations using keyless signing. Published indicators include: C2 domain metrics-trustwallet[.]com and IP 138.124.70.40 (Trust Wallet wave); file hashes router_init.js SHA-256 ab4fcadaec49c03278063dd269ea5eef82d24f2124a8e15d7b90f2fa8601266c and tanstack_runner.js SHA-256 2ec78d556d696e208927cc503d48e4b5eb56b31abc2870c2ed2e98d6be27fc96 (TanStack wave); C2 domains and infrastructure api.masscan.cloud, filev2.getsession.org, seed1.getsession.org, git-tanstack[.]com and IP 83.142.209[.]194; atool-wave C2 t.m-kosche.com; campaign encryption key 0c0e873033875f1bc471eda37e3b9d0f9b89bd41a4bbb4f86746caa2176c40aa; PBKDF2 salt svksjrhjkcejg; a ransom threat string set as npm token description, 'IfYouRevokeThisTokenItWillWipeTheComputerOfTheOwner'; GitHub account voicproducoes (ID 269549300); repository description marker \"Goldox-T3chs: Only Happy Girl\" (3.0 variant); and persistence artifacts .claude/settings.json, .claude/router_runtime.js, .vscode/tasks.json, .vscode/setup.mjs and the gh-token-monitor LaunchAgent/systemd files. Infected npm tarballs are identifiable by size (approximately 900 KB versus 190 KB for clean versions), root-level .js files outside standard distribution folders, and suspicious optionalDependencies entries pointing to attacker GitHub fork commits. Miasma encrypts its payload uniquely per infection, defeating hash-based detection for that variant. A Mastra-specific indicator is the typosquat package easy-day-js published by the account 'sergey2016'.","heading":"Technical Attack Mechanism and Indicators of Compromise","sources":[{"url":"https://snyk.io/blog/tanstack-npm-packages-compromised/","name":"TanStack npm Packages Hit by Mini Shai-Hulud (Snyk)","type":"research","credibility":2},{"url":"https://www.microsoft.com/en-us/security/blog/2025/12/09/shai-hulud-2-0-guidance-for-detecting-investigating-and-defending-against-the-supply-chain-attack/","name":"Microsoft Security Blog: Shai-Hulud 2.0 Guidance","type":"other","credibility":1},{"url":"https://expel.com/blog/mini-shai-hulud-cross-ecosystem-supply-chain-worm-targeting-npm-pypi/","name":"Mini Shai-Hulud: Cross-ecosystem supply chain worm targeting npm and PyPI (Expel)","type":"research","credibility":2},{"url":"https://www.vectra.ai/blog/shai-hulud-part-2-when-the-worm-forged-its-own-security-certificate","name":"Shai-Hulud Part 2: When the Worm Forged Its Own Security Certificate (Vectra)","type":"research","credibility":2},{"url":"https://www.stepsecurity.io/blog/mini-shai-hulud-is-back-a-self-spreading-supply-chain-attack-hits-the-npm-ecosystem","name":"TeamPCP's Mini Shai-Hulud Is Back: A Self-Spreading Supply Chain Attack Compromises TanStack npm Packages (StepSecurity)","type":"research","credibility":2},{"url":"https://orca.security/resources/blog/tanstack-npm-supply-chain-worm/","name":"TanStack and 160+ npm/PyPI Packages Compromised in Supply Chain Worm Attack (Orca Security)","type":"research","credibility":2},{"url":"https://www.wiz.io/blog/miasma-supply-chain-attack-targeting-redhat-npm-packages","name":"Miasma: Supply Chain Attack Targeting Red Hat npm Packages (Wiz)","type":"research","credibility":2},{"url":"https://gbhackers.com/sapphire-sleet-hijacks-npm/","name":"Sapphire Sleet Hijacks npm Maintainer Account to Publish Poisoned Mastra Packages (GBHackers)","type":"news_article","credibility":2}],"severity":"high"},{"content":"Following the open-sourcing of the framework, OX Security detected four malicious npm packages from threat actors independent of TeamPCP deploying Shai-Hulud clones. Derivative variants Miasma (npm) and Hades (PyPI) followed in June 2026. The open-sourced framework, a modular TypeScript/Bun toolkit for credential harvesting, supply chain poisoning, and encrypted exfiltration, enables rapid adaptation by actors with limited development capability. The NHS England Digital Cyber Alerts service issued advisory CC-4781 covering the Mini Shai-Hulud supply chain campaign, reflecting the breadth of the risk to enterprise software supply chains beyond the crypto sector. Unit 42's npm Threat Landscape tracker continued to document campaign activity as of June 2026. The risk of future waves, from TeamPCP and from copycat actors, is assessed as high given the open availability of attack tooling and the continuing prevalence of exploitable pull_request_target misconfigurations across open-source repositories.","heading":"Copycat Threat and Ongoing Risk","sources":[{"url":"https://www.ox.security/blog/shai-hulud-open-source-malware-github/","name":"Shai-Hulud Goes Open Source: Malware Creators Leak Their Own Code to GitHub (OX Security)","type":"research","credibility":2},{"url":"https://digital.nhs.uk/cyber-alerts/2026/cc-4781","name":"Supply Chain Attack Affecting Numerous npm and PyPI Packages (NHS England Digital - Cyber Alert CC-4781)","type":"regulatory","credibility":1},{"url":"https://securityboulevard.com/2026/05/mini-shai-hulud-frequently-asked-questions-about-the-teampcp-npm-and-pypi-supply-chain-campaign/","name":"Mini Shai-Hulud: Frequently Asked Questions about the TeamPCP npm and PyPI Supply Chain Campaign (Security Boulevard)","type":"research","credibility":2},{"url":"https://unit42.paloaltonetworks.com/monitoring-npm-supply-chain-attacks/","name":"The npm Threat Landscape: Attack Surface and Mitigations (Unit 42)","type":"research","credibility":1}],"severity":"high"},{"content":"Security researchers advise that the critical first step for developers potentially affected by Mini Shai-Hulud, Miasma, Hades, or related variants, before any credential rotation, is to locate and remove the gh-token-monitor persistence daemon; revoking GitHub tokens before removing it triggers the DEADMAN_SWITCH wiper, which executes rm -rf ~/ and destroys the home directory. Persistence locations to check are ~/Library/LaunchAgents/com.user.gh-token-monitor.plist (macOS) and ~/.config/systemd/user/gh-token-monitor.service (Linux). After daemon removal, all credentials should be rotated: npm tokens, GitHub personal access tokens and OIDC configurations, AWS/GCP/Azure service account keys, Kubernetes service account tokens, CI/CD secrets, SSH keys, HashiCorp Vault tokens, and Docker credentials. All cryptocurrency wallet seeds, private keys, and browser extension access should be considered compromised if an infected package was installed on a machine holding crypto assets. Developers should audit lockfiles and CI logs for affected package versions, inspect .claude/ and .vscode/ directories for payload artifacts, and block identified C2 infrastructure at DNS and proxy level. Packages installed from affected namespaces during the respective compromise windows around May 12, 2026 (TanStack), June 1, 2026 (Red Hat) or June 17, 2026 (Mastra) should be treated as potentially infected, upgraded to clean versions published after those dates, and verified using lockfile checksums.","heading":"Mitigation and Remediation","sources":[{"url":"https://orca.security/resources/blog/tanstack-npm-supply-chain-worm/","name":"TanStack and 160+ npm/PyPI Packages Compromised in Supply Chain Worm Attack (Orca Security)","type":"research","credibility":2},{"url":"https://www.deepwatch.com/labs/ca-26-018-miasma-mini-shai-hulud-compromise-of-red-hat-npm-packages/","name":"CA-26-018: Miasma/Mini Shai-Hulud Compromise of Red Hat npm Packages (Deepwatch)","type":"research","credibility":2},{"url":"https://www.aikido.dev/blog/red-hat-npm-packages-compromised-credential-stealing-worm","name":"Red Hat npm Packages Compromised to Spread a Credential-Stealing Worm (Aikido Security)","type":"research","credibility":2}],"severity":"high"}],"timeline":[{"date":"2025-09","event":"Original Shai-Hulud worm first detected in the npm ecosystem; earliest attributable TeamPCP supply chain operations begin. 500+ packages compromised via malicious preinstall hooks; credentials harvested from 25,000+ GitHub repositories.","source":"Unit 42 / SecurityWeek","source_url":"https://unit42.paloaltonetworks.com/monitoring-npm-supply-chain-attacks/"},{"date":"2025-11","event":"Shai-Hulud 2.0 peak activity: 640+ npm packages infected within days; 25,000+ data-leaking GitHub repositories created; Zapier, PostHog, and Postman developer tooling among affected parties.","source":"SecurityWeek","source_url":"https://www.securityweek.com/shai-hulud-supply-chain-attack-led-to-8-5-million-trust-wallet-heist/"},{"date":"2025-12","event":"Attacker registers domain metrics-trustwallet[.]com in preparation for the Trust Wallet extension compromise.","source":"SlowMist Christmas Heist Analysis","source_url":"https://slowmist.medium.com/christmas-heist-analysis-of-trust-wallet-browser-extension-hack-bdb35c3cc6dd"},{"date":"2025-12","event":"Microsoft Security Blog publishes formal Shai-Hulud 2.0 detection, investigation, and defense guidance.","source":"Microsoft Security Blog","source_url":"https://www.microsoft.com/en-us/security/blog/2025/12/09/shai-hulud-2-0-guidance-for-detecting-investigating-and-defending-against-the-supply-chain-attack/"},{"date":"2025-12","event":"Malicious Trust Wallet Chrome extension v2.68 published at about 12:32 PM UTC using a stolen Chrome Web Store API key; wallet mnemonic harvesting begins.","source":"Trust Wallet official incident update","source_url":"https://trustwallet.com/blog/announcements/trust-wallet-browser-extension-v268-incident-community-update"},{"date":"2025-12","event":"Security researchers publicly report wallet drains; Trust Wallet acknowledges the incident.","source":"The Hacker News","source_url":"https://thehackernews.com/2025/12/trust-wallet-chrome-extension-hack.html"},{"date":"2025-12","event":"Trust Wallet exfiltration window closes at 11:00 UTC; clean version 2.69 released and reimbursement process initiated. Losses reported at more than $7 million by CoinDesk and approximately $8.5 million across 2,520 wallets in later reporting.","source":"CoinDesk","source_url":"https://www.coindesk.com/business/2025/12/26/trust-wallet-users-lose-more-than-usd7-million-to-hacked-chrome-extension"},{"date":"2025-12","event":"Shai-Hulud 3.0 'The Golden Path' variant discovered by researcher Charlie Eriksen propagating via @vietmoney/react-big-calendar@0.26.2; dead-man's switch absent from this variant.","source":"Snyk","source_url":"https://snyk.io/blog/shai-hulud-3-0/"},{"date":"2026-03","event":"Attacker GitHub account 'voicproducoes' (ID 269549300) created.","source":"StepSecurity","source_url":"https://www.stepsecurity.io/blog/mini-shai-hulud-is-back-a-self-spreading-supply-chain-attack-hits-the-npm-ecosystem"},{"date":"2026-04","event":"Bitwarden CLI @bitwarden/cli@2026.4.0 compromised for approximately 93 minutes via a backdoored Checkmarx GitHub Actions workflow; 334 downloads of the malicious version; payload embedded the string 'Shai-Hulud: The Third Coming'.","source":"The Hacker News","source_url":"https://thehackernews.com/2026/04/bitwarden-cli-compromised-in-ongoing.html"},{"date":"2026-04","event":"The Register reports an npm supply chain worm attack attributed to TeamPCP activity.","source":"The Register","source_url":"https://www.theregister.com/2026/04/22/another_npm_supply_chain_attack/"},{"date":"2026-04","event":"Mini Shai-Hulud targets the SAP CAP ecosystem: @cap-js/sqlite, @cap-js/postgres, @cap-js/db-service, and mbt compromised (~570,000 combined weekly downloads).","source":"Dark Reading","source_url":"https://www.darkreading.com/cloud-security/teampcp-sap-packages-mini-shai-hulud"},{"date":"2026-04","event":"PyTorch Lightning compromise attributed to the TeamPCP campaign.","source":"SecurityWeek","source_url":"https://www.securityweek.com/over-100-npm-pypi-packages-hit-in-new-shai-hulud-supply-chain-attacks/"},{"date":"2026-05","event":"Attacker establishes a malicious fork of TanStack/router on GitHub.","source":"StepSecurity","source_url":"https://www.stepsecurity.io/blog/mini-shai-hulud-is-back-a-self-spreading-supply-chain-attack-hits-the-npm-ecosystem"},{"date":"2026-05","event":"Mini Shai-Hulud Wave 2 begins at 19:20 UTC: 84 malicious @tanstack package versions published in six minutes via a GitHub Actions pwn request, cache poisoning and OIDC token extraction. The worm spreads to 172 packages and 400+ malicious versions across npm and PyPI (within five hours per Orca Security; within 48 hours per other reporting). Two OpenAI employee devices compromised. CVE-2026-45321 (CVSS 9.6) assigned.","source":"StepSecurity / Orca Security","source_url":"https://www.stepsecurity.io/blog/mini-shai-hulud-is-back-a-self-spreading-supply-chain-attack-hits-the-npm-ecosystem"},{"date":"2026-05","event":"TeamPCP publishes the Shai-Hulud worm source code on GitHub under MIT License ('Open Sourcing The Carnage') alongside BreachForums posts encouraging independent campaigns; copycat forks appear within hours. Orca Security discloses 169 npm and 2 PyPI affected packages.","source":"The Register / Orca Security","source_url":"https://www.theregister.com/security/2026/05/13/malware-crew-teampcp-open-sources-its-shai-hulud-worm-on-github/5239319"},{"date":"2026-05","event":"GitHub employee installs trojanized Nx Console VS Code extension (2.2 million installs, verified publisher), live for about 11 minutes; TeamPCP allegedly exfiltrates approximately 3,800 GitHub internal repositories.","source":"Phoenix Security","source_url":"https://phoenix.security/vs-code-extension-malware-github-breach-teampcp-2026/"},{"date":"2026-05","event":"Mini Shai-Hulud Wave 3: compromised @antv / atool maintainer account used to publish 639 malicious versions across 323 packages (including AntV, jest-canvas-mock, echarts-for-react) in ~22 minutes (~16 million weekly downloads).","source":"Snyk / Wiz / Phoenix Security","source_url":"https://snyk.io/blog/mini-shai-hulud-antv-npm-supply-chain-attack/"},{"date":"2026-06","event":"Miasma variant deployed against the @redhat-cloud-services npm namespace via a compromised Red Hat employee GitHub account: 96 malicious versions across 32 packages in two waves (10:53 UTC and 13:44-13:46 UTC); assessed as a Shai-Hulud derivative by Unit 42 and SANS ISC.","source":"Wiz / Aikido Security / Unit 42","source_url":"https://www.wiz.io/blog/miasma-supply-chain-attack-targeting-redhat-npm-packages"},{"date":"2026-06","event":"At least 57 npm packages and 300+ malicious versions identified under the Miasma/Hades umbrella; more than 471 malicious artifacts across ecosystems documented.","source":"SecurityWeek","source_url":"https://www.securityweek.com/over-100-npm-pypi-packages-hit-in-new-shai-hulud-supply-chain-attacks/"},{"date":"2026-06","event":"Hades PyPI variant second wave: at least 29 additional PyPI packages compromised, targeting bioinformatics, graph ML, and MCP-themed packages.","source":"SecurityWeek","source_url":"https://www.securityweek.com/over-100-npm-pypi-packages-hit-in-new-shai-hulud-supply-chain-attacks/"},{"date":"2026-06","event":"OpenAI deadline for users to update ChatGPT Desktop, Codex App, Codex CLI, and Atlas to versions signed with new certificates; old code-signing certificates revoked.","source":"OpenAI","source_url":"https://openai.com/index/our-response-to-the-tanstack-npm-supply-chain-attack/"},{"date":"2026-06","event":"141 Mastra AI npm packages (~8 million combined weekly downloads) compromised in a 45-minute window via the typosquat dependency easy-day-js; Microsoft attributes the attack to the North Korean group Sapphire Sleet (BlueNoroff).","source":"Microsoft Security Blog / SecurityWeek","source_url":"https://www.microsoft.com/en-us/security/blog/2026/06/17/postinstall-payload-inside-mastra-npm-supply-chain-compromise/"}],"sources_used":[{"url":"https://thehackernews.com/2025/12/trust-wallet-chrome-extension-hack.html","name":"Trust Wallet Chrome Extension Hack Drains $8.5M via Shai-Hulud Supply Chain Attack (The Hacker News)","type":"news_article","archive_url":"http://web.archive.org/web/20260630113554/https://thehackernews.com/2025/12/trust-wallet-chrome-extension-hack.html","credibility":2,"archive_timestamp":"2026-06-30T11:35:54+00:00"},{"url":"https://trustwallet.com/blog/announcements/trust-wallet-browser-extension-v268-incident-community-update","name":"Trust Wallet Browser Extension v2.68 Incident: An Update to Our Community (Trust Wallet official blog)","type":"official","archive_url":"http://web.archive.org/web/20260717084313/https://trustwallet.com/blog/announcements/trust-wallet-browser-extension-v268-incident-community-update","credibility":1,"archive_timestamp":"2026-07-17T08:43:13+00:00"},{"url":"https://www.microsoft.com/en-us/security/blog/2025/12/09/shai-hulud-2-0-guidance-for-detecting-investigating-and-defending-against-the-supply-chain-attack/","name":"Microsoft Security Blog: Shai-Hulud 2.0 - Guidance for Detecting, Investigating, and Defending Against the Supply Chain Attack","type":"other","archive_url":"http://web.archive.org/web/20260713164047/https://www.microsoft.com/en-us/security/blog/2025/12/09/shai-hulud-2-0-guidance-for-detecting-investigating-and-defending-against-the-supply-chain-attack/","credibility":1,"archive_timestamp":"2026-07-13T16:40:47+00:00"},{"url":"https://www.securityweek.com/shai-hulud-supply-chain-attack-led-to-8-5-million-trust-wallet-heist/","name":"SecurityWeek: Shai-Hulud Supply Chain Attack Led to $8.5 Million Trust Wallet Heist","type":"news_article","archive_url":"http://web.archive.org/web/20260331154611/https://www.securityweek.com/shai-hulud-supply-chain-attack-led-to-8-5-million-trust-wallet-heist/","credibility":2,"archive_timestamp":"2026-03-31T15:46:11+00:00"},{"url":"https://slowmist.medium.com/christmas-heist-analysis-of-trust-wallet-browser-extension-hack-bdb35c3cc6dd","name":"Christmas Heist | Analysis of Trust Wallet Browser Extension Hack (SlowMist)","type":"research","archive_url":"http://web.archive.org/web/20251229210855/https://slowmist.medium.com/christmas-heist-analysis-of-trust-wallet-browser-extension-hack-bdb35c3cc6dd","credibility":2,"archive_timestamp":"2025-12-29T21:08:55+00:00"},{"url":"https://www.halborn.com/blog/post/explained-the-trust-wallet-hack-december-2025","name":"Explained: The Trust Wallet Hack (December 2025) (Halborn)","type":"research","archive_url":"http://web.archive.org/web/20260517002726/https://www.halborn.com/blog/post/explained-the-trust-wallet-hack-december-2025","credibility":2,"archive_timestamp":"2026-05-17T00:27:26+00:00"},{"url":"https://www.coindesk.com/business/2025/12/26/trust-wallet-users-lose-more-than-usd7-million-to-hacked-chrome-extension","name":"Users of Binance-owned Trust Wallet lose $7 million to hacked Chrome extension (CoinDesk)","type":"news_article","archive_url":"http://web.archive.org/web/20260213014350/https://www.coindesk.com/business/2025/12/26/trust-wallet-users-lose-more-than-usd7-million-to-hacked-chrome-extension","credibility":1,"archive_timestamp":"2026-02-13T01:43:50+00:00"},{"url":"https://www.stepsecurity.io/blog/mini-shai-hulud-is-back-a-self-spreading-supply-chain-attack-hits-the-npm-ecosystem","name":"TeamPCP's Mini Shai-Hulud Is Back: A Self-Spreading Supply Chain Attack Compromises TanStack npm Packages (StepSecurity)","type":"research","archive_url":"http://web.archive.org/web/20260723005415/https://www.stepsecurity.io/blog/mini-shai-hulud-is-back-a-self-spreading-supply-chain-attack-hits-the-npm-ecosystem","credibility":2,"archive_timestamp":"2026-07-23T00:54:15+00:00"},{"url":"https://snyk.io/blog/tanstack-npm-packages-compromised/","name":"TanStack npm Packages Hit by Mini Shai-Hulud (Snyk)","type":"research","archive_url":"http://web.archive.org/web/20260722234912/https://snyk.io/blog/tanstack-npm-packages-compromised/","credibility":2,"archive_timestamp":"2026-07-22T23:49:12+00:00"},{"url":"https://thehackernews.com/2026/05/mini-shai-hulud-worm-compromises.html","name":"Mini Shai-Hulud Worm Compromises TanStack, Mistral AI, Guardrails AI and More Packages (The Hacker News)","type":"news_article","archive_url":"http://web.archive.org/web/20260628082039/https://thehackernews.com/2026/05/mini-shai-hulud-worm-compromises.html","credibility":2,"archive_timestamp":"2026-06-28T08:20:39+00:00"},{"url":"https://unit42.paloaltonetworks.com/monitoring-npm-supply-chain-attacks/","name":"The npm Threat Landscape: Attack Surface and Mitigations (Unit 42)","type":"research","archive_url":"http://web.archive.org/web/20260723005417/https://unit42.paloaltonetworks.com/monitoring-npm-supply-chain-attacks/","credibility":1,"archive_timestamp":"2026-07-23T00:54:17+00:00"},{"url":"https://unit42.paloaltonetworks.com/teampcp-supply-chain-attacks/","name":"Weaponizing the Protectors: TeamPCP's Multi-Stage Supply Chain Attack on Security Infrastructure (Unit 42)","type":"research","archive_url":"http://web.archive.org/web/20260723005418/https://unit42.paloaltonetworks.com/teampcp-supply-chain-attacks/","credibility":1,"archive_timestamp":"2026-07-23T00:54:18+00:00"},{"url":"https://www.reversinglabs.com/blog/mini-shai-hulud-tears-at-oss-trust","name":"Team PCP's Mini Shai-Hulud tears at open-source trust (ReversingLabs)","type":"research","archive_url":"https://web.archive.org/web/20260726110825/https://www.reversinglabs.com/blog/mini-shai-hulud-tears-at-oss-trust","credibility":2,"archive_timestamp":"2026-07-26T11:08:25+00:00"},{"url":"https://www.tenable.com/blog/mini-shai-hulud-frequently-asked-questions","name":"Mini Shai-Hulud Supply Chain Attack CVE-2026-45321 FAQ (Tenable)","type":"research","archive_url":"http://web.archive.org/web/20260704191810/https://www.tenable.com/blog/mini-shai-hulud-frequently-asked-questions","credibility":2,"archive_timestamp":"2026-07-04T19:18:10+00:00"},{"url":"https://www.mend.io/blog/mini-shai-hulud-is-back-172-npm-and-pypi-packages-compromised-in-latest-wave/","name":"Mini Shai-Hulud Wave Hits 172 npm and PyPI Packages (Mend.io)","type":"research","archive_url":"http://web.archive.org/web/20260512054821/https://www.mend.io/blog/mini-shai-hulud-is-back-172-npm-and-pypi-packages-compromised-in-latest-wave/","credibility":2,"archive_timestamp":"2026-05-12T05:48:21+00:00"},{"url":"https://snyk.io/blog/mini-shai-hulud-antv-npm-supply-chain-attack/","name":"Mini Shai-Hulud Hits AntV: 300+ Malicious npm Packages Published via Compromised Maintainer Account (Snyk)","type":"research","archive_url":"http://web.archive.org/web/20260722234905/https://snyk.io/blog/mini-shai-hulud-antv-npm-supply-chain-attack/","credibility":2,"archive_timestamp":"2026-07-22T23:49:05+00:00"},{"url":"https://www.wiz.io/blog/mini-shai-hulud-teampcp-hits-antv-supply-chain","name":"The Worm That Keeps on Digging: TeamPCP Hits @antv in Latest Wave (Wiz)","type":"research","archive_url":"http://web.archive.org/web/20260714154415/https://www.wiz.io/blog/mini-shai-hulud-teampcp-hits-antv-supply-chain","credibility":2,"archive_timestamp":"2026-07-14T15:44:15+00:00"},{"url":"https://www.theregister.com/security/2026/05/13/malware-crew-teampcp-open-sources-its-shai-hulud-worm-on-github/5239319","name":"Malware crew TeamPCP open-sources its Shai-Hulud worm on GitHub (The Register)","type":"news_article","archive_url":"http://web.archive.org/web/20260715211941/https://www.theregister.com/security/2026/05/13/malware-crew-teampcp-open-sources-its-shai-hulud-worm-on-github/5239319","credibility":1,"archive_timestamp":"2026-07-15T21:19:41+00:00"},{"url":"https://www.ox.security/blog/shai-hulud-open-source-malware-github/","name":"Shai-Hulud Goes Open Source: Malware Creators Leak Their Own Code to GitHub (OX Security)","type":"research","archive_url":"http://web.archive.org/web/20260720002803/https://www.ox.security/blog/shai-hulud-open-source-malware-github/","credibility":2,"archive_timestamp":"2026-07-20T00:28:03+00:00"},{"url":"https://securitylabs.datadoghq.com/articles/shai-hulud-open-source-framework-static-analysis/","name":"Shai-Hulud Goes Open Source - static analysis (Datadog Security Labs)","type":"research","archive_url":"http://web.archive.org/web/20260715094146/https://securitylabs.datadoghq.com/articles/shai-hulud-open-source-framework-static-analysis/","credibility":2,"archive_timestamp":"2026-07-15T09:41:46+00:00"},{"url":"https://snyk.io/blog/shai-hulud-3-0/","name":"The Holiday Whisper: Shai-Hulud 3.0 (Snyk)","type":"research","archive_url":"http://web.archive.org/web/20260724211219/https://snyk.io/blog/shai-hulud-3-0/","credibility":2,"archive_timestamp":"2026-07-24T21:12:19+00:00"},{"url":"https://threats.wiz.io/all-actors/teampcp","name":"TeamPCP - Cloud Threat Landscape (Wiz Threat Actors)","type":"research","archive_url":"http://web.archive.org/web/20260723002123/https://threats.wiz.io/all-actors/teampcp","credibility":2,"archive_timestamp":"2026-07-23T00:21:23+00:00"},{"url":"https://isc.sans.edu/diary/32846","name":"TeamPCP Supply Chain Campaign: Update 004 - Databricks Investigating Alleged Compromise (SANS ISC)","type":"research","archive_url":"http://web.archive.org/web/20260512184535/https://isc.sans.edu/diary/32846","credibility":2,"archive_timestamp":"2026-05-12T18:45:35+00:00"},{"url":"https://industrialcyber.co/ransomware/vect-formalizes-breachforums-and-teampcp-alliance-to-push-model-for-industrialized-ransomware-scale-raas-operations/","name":"Vect formalizes BreachForums and TeamPCP alliance to push model for industrialized ransomware (Industrial Cyber)","type":"news_article","archive_url":"http://web.archive.org/web/20260421113434/https://industrialcyber.co/ransomware/vect-formalizes-breachforums-and-teampcp-alliance-to-push-model-for-industrialized-ransomware-scale-raas-operations/","credibility":2,"archive_timestamp":"2026-04-21T11:34:34+00:00"},{"url":"https://www.theregister.com/2026/04/28/dont_pay_vect_a_ransom/","name":"Don't pay VECT a ransom - your big files are likely gone (The Register)","type":"news_article","archive_url":"http://web.archive.org/web/20260501231514/https://www.theregister.com/2026/04/28/dont_pay_vect_a_ransom/","credibility":1,"archive_timestamp":"2026-05-01T23:15:14+00:00"},{"url":"https://thehackernews.com/2026/04/bitwarden-cli-compromised-in-ongoing.html","name":"Bitwarden CLI Compromised in Ongoing Checkmarx Supply Chain Campaign (The Hacker News)","type":"news_article","archive_url":"http://web.archive.org/web/20260709124228/https://thehackernews.com/2026/04/bitwarden-cli-compromised-in-ongoing.html","credibility":2,"archive_timestamp":"2026-07-09T12:42:28+00:00"},{"url":"https://digital.nhs.uk/cyber-alerts/2026/cc-4781","name":"Supply Chain Attack Affecting Numerous npm and PyPI Packages (NHS England Digital - Cyber Alert CC-4781)","type":"regulatory","archive_url":"http://web.archive.org/web/20260514182212/https://digital.nhs.uk/cyber-alerts/2026/cc-4781","credibility":1,"archive_timestamp":"2026-05-14T18:22:12+00:00"},{"url":"https://securityboulevard.com/2026/05/mini-shai-hulud-frequently-asked-questions-about-the-teampcp-npm-and-pypi-supply-chain-campaign/","name":"Mini Shai-Hulud: Frequently Asked Questions about the TeamPCP npm and PyPI Supply Chain Campaign (Security Boulevard)","type":"research","archive_url":"http://web.archive.org/web/20260522082810/https://securityboulevard.com/2026/05/mini-shai-hulud-frequently-asked-questions-about-the-teampcp-npm-and-pypi-supply-chain-campaign/","credibility":2,"archive_timestamp":"2026-05-22T08:28:10+00:00"},{"url":"https://www.darkreading.com/cloud-security/teampcp-sap-packages-mini-shai-hulud","name":"TeamPCP Hits SAP Packages With 'Mini Shai-Hulud' Attack (Dark Reading)","type":"news_article","archive_url":"http://web.archive.org/web/20260503110828/https://www.darkreading.com/cloud-security/teampcp-sap-packages-mini-shai-hulud","credibility":2,"archive_timestamp":"2026-05-03T11:08:28+00:00"},{"url":"https://www.akamai.com/blog/security-research/mini-shai-hulud-worm-returns-goes-public","name":"Mini Shai-Hulud: The Worm Returns and Goes Public (Akamai)","type":"research","archive_url":"http://web.archive.org/web/20260611232056/https://www.akamai.com/blog/security-research/mini-shai-hulud-worm-returns-goes-public","credibility":2,"archive_timestamp":"2026-06-11T23:20:56+00:00"},{"url":"https://expel.com/blog/mini-shai-hulud-cross-ecosystem-supply-chain-worm-targeting-npm-pypi/","name":"Mini Shai-Hulud: Cross-ecosystem supply chain worm targeting npm and PyPI (Expel)","type":"research","archive_url":"https://web.archive.org/web/20260726224045/https://expel.com/blog/mini-shai-hulud-cross-ecosystem-supply-chain-worm-targeting-npm-pypl/","credibility":2,"archive_timestamp":"2026-07-26T22:40:45+00:00"},{"url":"https://socradar.io/blog/dark-web-profile-teampcp/","name":"Dark Web Profile: TeamPCP (SOCRadar)","type":"research","archive_url":"http://web.archive.org/web/20260907052912/https://socradar.io/blog/dark-web-profile-teampcp/","credibility":2,"archive_timestamp":"2026-09-07T05:29:12+00:00"},{"url":"https://flare.io/learn/resources/blog/teampcp-cloud-native-ransomware","name":"Threat Alert: TeamPCP, An Emerging Force in the Cloud Native and Ransomware Landscape (Flare)","type":"research","archive_url":"http://web.archive.org/web/20260908053035/https://flare.io/learn/resources/blog/teampcp-cloud-native-ransomware","credibility":2,"archive_timestamp":"2026-09-08T05:30:35+00:00"},{"url":"https://cybersecuritynews.com/shai-hulud-worm-steals-npm/","name":"Shai-Hulud Worm Steals npm, GitHub, AWS, and Kubernetes Secrets From Developers (CybersecurityNews)","type":"news_article","archive_url":"http://web.archive.org/web/20260517010407/https://cybersecuritynews.com/shai-hulud-worm-steals-npm/","credibility":2,"archive_timestamp":"2026-05-17T01:04:07+00:00"},{"url":"https://www.kodemsecurity.com/resources/guess-whos-back-shai-hulud-3-0-the-golden-path","name":"Guess Who's Back: Shai-Hulud 3.0 The Golden Path (Kodem Security)","type":"research","archive_url":"http://web.archive.org/web/20260415095033/https://www.kodemsecurity.com/resources/guess-whos-back-shai-hulud-3-0-the-golden-path","credibility":2,"archive_timestamp":"2026-04-15T09:50:33+00:00"},{"url":"https://cybernews.com/security/shai-hulud-malware-3rd-variant-detected-supply-chain-threat/","name":"New Shai-Hulud 3.0 malware variant discovered (Cybernews)","type":"news_article","archive_url":"http://web.archive.org/web/20260101005559/https://cybernews.com/security/shai-hulud-malware-3rd-variant-detected-supply-chain-threat/","credibility":2,"archive_timestamp":"2026-01-01T00:55:59+00:00"},{"url":"https://www.techloy.com/bitwarden-cli-compromised-in-shai-hulud-supply-chain-attack-334-developers-exposed/","name":"Bitwarden CLI Compromised in 'Shai-Hulud' Supply Chain Attack; 334 Developers Exposed (Techloy)","type":"news_article","archive_url":"http://web.archive.org/web/20260519093407/https://www.techloy.com/bitwarden-cli-compromised-in-shai-hulud-supply-chain-attack-334-developers-exposed/","credibility":2,"archive_timestamp":"2026-05-19T09:34:07+00:00"},{"url":"https://www.securityweek.com/bitwarden-npm-package-hit-in-supply-chain-attack/","name":"Bitwarden NPM Package Hit in Supply Chain Attack (SecurityWeek)","type":"news_article","archive_url":"http://web.archive.org/web/20260704143855/https://www.securityweek.com/bitwarden-npm-package-hit-in-supply-chain-attack/","credibility":2,"archive_timestamp":"2026-07-04T14:38:55+00:00"},{"url":"https://socradar.io/blog/bitwarden-cli-hijacked-npm-supply-chain-teampcp/","name":"Bitwarden CLI Hijacked in npm Supply Chain Attack Linked to TeamPCP and Checkmarx Breach (SOCRadar)","type":"research","archive_url":"http://web.archive.org/web/20260501120356/https://socradar.io/blog/bitwarden-cli-hijacked-npm-supply-chain-teampcp/","credibility":2,"archive_timestamp":"2026-05-01T12:03:56+00:00"},{"url":"https://mondoo.com/blog/shai-hulud-clones-arrive-when-worm-source-code-goes-open-source","name":"When Worm Source Code Goes Open Source: The Shai-Hulud Clones Arrive (Mondoo)","type":"research","archive_url":"http://web.archive.org/web/20260519155329/https://mondoo.com/blog/shai-hulud-clones-arrive-when-worm-source-code-goes-open-source","credibility":2,"archive_timestamp":"2026-05-19T15:53:29+00:00"},{"url":"https://www.dataminr.com/resources/intel-brief/vect-breachforums-teampcp-converge-in-unprecedented-affiliate-mobilizatio/","name":"Cyber Intel Brief: Vect, BreachForums, and TeamPCP Converge (Dataminr)","type":"research","archive_url":"http://web.archive.org/web/20260512062116/https://www.dataminr.com/resources/intel-brief/vect-breachforums-teampcp-converge-in-unprecedented-affiliate-mobilizatio/","credibility":2,"archive_timestamp":"2026-05-12T06:21:16+00:00"},{"url":"https://labs.cloudsecurityalliance.org/research/csa-research-note-vect2-ransomware-wiper-unrecoverable-20260/","name":"VECT 2.0: Paying the Ransom Cannot Recover Enterprise Data (Cloud Security Alliance Labs)","type":"research","archive_url":"http://web.archive.org/web/20261002104441/https://labs.cloudsecurityalliance.org/research/csa-research-note-vect2-ransomware-wiper-unrecoverable-20260/","credibility":2,"archive_timestamp":"2026-10-02T10:44:41+00:00"},{"url":"https://www.vectra.ai/blog/shai-hulud-part-2-when-the-worm-forged-its-own-security-certificate","name":"Shai-Hulud Part 2: When the Worm Forged Its Own Security Certificate (Vectra)","type":"research","archive_url":"http://web.archive.org/web/20260606070637/https://www.vectra.ai/blog/shai-hulud-part-2-when-the-worm-forged-its-own-security-certificate","credibility":2,"archive_timestamp":"2026-06-06T07:06:37+00:00"},{"url":"https://www.how2shout.com/news/trust-wallet-chrome-extension-hack-8-5-million-stolen-v2-68-2025.html","name":"Trust Wallet Chrome Extension Hack: $8.5 Million Stolen via v2.68 (H2S Media)","type":"news_article","archive_url":"http://web.archive.org/web/20260103102507/https://www.how2shout.com/news/trust-wallet-chrome-extension-hack-8-5-million-stolen-v2-68-2025.html","credibility":3,"archive_timestamp":"2026-01-03T10:25:07+00:00"},{"url":"https://thehackernews.com/2026/05/tanstack-supply-chain-attack-hits-two.html","name":"TanStack Supply Chain Attack Hits Two OpenAI Employee Devices (The Hacker News)","type":"news_article","archive_url":"http://web.archive.org/web/20260517160554/https://thehackernews.com/2026/05/tanstack-supply-chain-attack-hits-two.html","credibility":2,"archive_timestamp":"2026-05-17T16:05:54+00:00"},{"url":"https://www.securityweek.com/north-korean-hackers-blamed-for-mastra-npm-supply-chain-attack/","name":"North Korean Hackers Blamed for Mastra NPM Supply Chain Attack (SecurityWeek)","type":"news_article","archive_url":"http://web.archive.org/web/20260623090504/https://www.securityweek.com/north-korean-hackers-blamed-for-mastra-npm-supply-chain-attack/","credibility":2,"archive_timestamp":"2026-06-23T09:05:04+00:00"},{"url":"https://openai.com/index/our-response-to-the-tanstack-npm-supply-chain-attack/","name":"Our Response to the TanStack npm Supply Chain Attack (OpenAI)","type":"official","archive_url":"http://web.archive.org/web/20260724004245/https://openai.com/index/our-response-to-the-tanstack-npm-supply-chain-attack/","credibility":1,"archive_timestamp":"2026-07-24T00:42:45+00:00"},{"url":"https://orca.security/resources/blog/tanstack-npm-supply-chain-worm/","name":"TanStack and 160+ npm/PyPI Packages Compromised in Supply Chain Worm Attack (Orca Security)","type":"research","archive_url":"http://web.archive.org/web/20260719084521/https://orca.security/resources/blog/tanstack-npm-supply-chain-worm/","credibility":2,"archive_timestamp":"2026-07-19T08:45:21+00:00"},{"url":"https://www.microsoft.com/en-us/security/blog/2026/06/17/postinstall-payload-inside-mastra-npm-supply-chain-compromise/","name":"From package to postinstall payload: Inside the Mastra npm supply chain compromise by Sapphire Sleet (Microsoft Security Blog)","type":"research","archive_url":"http://web.archive.org/web/20260724215337/https://www.microsoft.com/en-us/security/blog/2026/06/17/postinstall-payload-inside-mastra-npm-supply-chain-compromise/","credibility":1,"archive_timestamp":"2026-07-24T21:53:37+00:00"},{"url":"https://www.wiz.io/blog/miasma-supply-chain-attack-targeting-redhat-npm-packages","name":"Miasma: Supply Chain Attack Targeting Red Hat npm Packages (Wiz)","type":"research","archive_url":"http://web.archive.org/web/20260722055210/https://www.wiz.io/blog/miasma-supply-chain-attack-targeting-redhat-npm-packages","credibility":2,"archive_timestamp":"2026-07-22T05:52:10+00:00"},{"url":"https://www.aikido.dev/blog/red-hat-npm-packages-compromised-credential-stealing-worm","name":"Red Hat npm Packages Compromised to Spread a Credential-Stealing Worm (Aikido Security)","type":"research","archive_url":"http://web.archive.org/web/20260720013711/https://www.aikido.dev/blog/red-hat-npm-packages-compromised-credential-stealing-worm","credibility":2,"archive_timestamp":"2026-07-20T01:37:11+00:00"},{"url":"https://www.theregister.com/security/2026/06/01/shai-hulud-malware-infects-red-hat-npm-packages-downloaded-80k-times-weekly/5249803","name":"Shai-Hulud malware worms Red Hat npm package versions downloaded 80K times a week (The Register)","type":"news_article","archive_url":"http://web.archive.org/web/20260726085001/https://www.theregister.com/security/2026/06/01/shai-hulud-malware-infects-red-hat-npm-packages-downloaded-80k-times-weekly/5249803","credibility":2,"archive_timestamp":"2026-07-26T08:50:01+00:00"},{"url":"https://thehackernews.com/2026/06/miasma-supply-chain-attack-compromises.html","name":"Miasma Supply Chain Attack Compromises Red Hat npm Packages (The Hacker News)","type":"news_article","archive_url":"http://web.archive.org/web/20260722034737/https://thehackernews.com/2026/06/miasma-supply-chain-attack-compromises.html","credibility":2,"archive_timestamp":"2026-07-22T03:47:37+00:00"},{"url":"https://www.securityweek.com/over-100-npm-pypi-packages-hit-in-new-shai-hulud-supply-chain-attacks/","name":"Over 100 NPM, PyPI Packages Hit in New Shai-Hulud Supply Chain Attacks (SecurityWeek)","type":"news_article","archive_url":"http://web.archive.org/web/20260724001916/https://www.securityweek.com/over-100-npm-pypi-packages-hit-in-new-shai-hulud-supply-chain-attacks/","credibility":2,"archive_timestamp":"2026-07-24T00:19:16+00:00"},{"url":"https://phoenix.security/teampcp-mini-shai-hulud-npm-atool-maintainer-compromise-2026/","name":"TeamPCP / Mini Shai-Hulud npm Campaign: 600 Packages, Confirmed Active Payload (Phoenix Security)","type":"research","archive_url":"http://web.archive.org/web/20260726145033/https://phoenix.security/teampcp-mini-shai-hulud-npm-atool-maintainer-compromise-2026/","credibility":2,"archive_timestamp":"2026-07-26T14:50:33+00:00"},{"url":"https://phoenix.security/miasma-redhat-cloud-services-npm-supply-chain-shai-hulud-variant/","name":"Miasma NPM Supply Chain Attack: Red Hat Cloud Services npm Packages (Phoenix Security)","type":"research","archive_url":"http://web.archive.org/web/20260727003559/https://phoenix.security/miasma-redhat-cloud-services-npm-supply-chain-shai-hulud-variant/","credibility":2,"archive_timestamp":"2026-07-27T00:35:59+00:00"},{"url":"https://phoenix.security/teampcp-supply-chain-attack-trivy-checkmarx-github-actions-npm-canisterworm/","name":"TeamPCP Supply Chain Attack: Trivy to Checkmarx to npm (2026) (Phoenix Security)","type":"research","archive_url":"http://web.archive.org/web/20260411234309/https://phoenix.security/teampcp-supply-chain-attack-trivy-checkmarx-github-actions-npm-canisterworm/","credibility":2,"archive_timestamp":"2026-04-11T23:43:09+00:00"},{"url":"https://phoenix.security/vs-code-extension-malware-github-breach-teampcp-2026/","name":"GitHub Internal Repository Breach via Poisoned VS Code Extension (May 2026) (Phoenix Security)","type":"research","archive_url":"http://web.archive.org/web/20260610235749/https://phoenix.security/vs-code-extension-malware-github-breach-teampcp-2026/","credibility":2,"archive_timestamp":"2026-06-10T23:57:49+00:00"},{"url":"https://www.deepwatch.com/labs/ca-26-018-miasma-mini-shai-hulud-compromise-of-red-hat-npm-packages/","name":"CA-26-018: Miasma/Mini Shai-Hulud Compromise of Red Hat npm Packages (Deepwatch)","type":"research","archive_url":"https://web.archive.org/web/20260726230545/https://www.deepwatch.com/labs/ca-26-018-miasma-mini-shai-hulud-compromise-of-red-hat-npm-packages/","credibility":2,"archive_timestamp":"2026-07-26T23:05:45+00:00"},{"url":"https://labs.cloudsecurityalliance.org/research/csa-research-note-teampcp-multi-ecosystem-supply-chain-20260/","name":"TeamPCP: Multi-Ecosystem Supply Chain Worm (CSA Research Note)","type":"research","archive_url":"http://web.archive.org/web/20260901092721/https://labs.cloudsecurityalliance.org/research/csa-research-note-teampcp-multi-ecosystem-supply-chain-20260/","credibility":2,"archive_timestamp":"2026-09-01T09:27:21+00:00"},{"url":"https://www.bleepingcomputer.com/news/security/microsoft-links-mastra-ai-supply-chain-attack-to-north-korean-hackers/","name":"Microsoft links Mastra AI supply chain attack to North Korean hackers (BleepingComputer)","type":"news_article","archive_url":"http://web.archive.org/web/20260717114119/https://www.bleepingcomputer.com/news/security/microsoft-links-mastra-ai-supply-chain-attack-to-north-korean-hackers/","credibility":2,"archive_timestamp":"2026-07-17T11:41:19+00:00"},{"url":"https://www.aikido.dev/blog/over-140-popular-mastra-npm-packages-hit-by-supply-chain-attack","name":"Over 140 popular Mastra npm Packages Hit by Supply Chain Attack (Aikido Security)","type":"research","archive_url":"http://web.archive.org/web/20260702200308/https://www.aikido.dev/blog/over-140-popular-mastra-npm-packages-hit-by-supply-chain-attack","credibility":2,"archive_timestamp":"2026-07-02T20:03:08+00:00"},{"url":"https://www.upwind.io/feed/miasma-npm-supply-chain-worm-redhat-credential-harvest","name":"Miasma: A Worming npm Supply Chain Attack on Red Hat Cloud Services (Upwind)","type":"research","archive_url":"http://web.archive.org/web/20260726162321/https://www.upwind.io/feed/miasma-npm-supply-chain-worm-redhat-credential-harvest","credibility":2,"archive_timestamp":"2026-07-26T16:23:21+00:00"},{"url":"https://blog.gitguardian.com/three-supply-chain-campaigns-hit-npm-pypi-and-docker-hub-in-48-hours/","name":"No Off Season: Three Supply Chain Campaigns Hit npm, PyPI, and Docker Hub in 48 Hours (GitGuardian)","type":"research","archive_url":"http://web.archive.org/web/20260529073849/https://blog.gitguardian.com/three-supply-chain-campaigns-hit-npm-pypi-and-docker-hub-in-48-hours/","credibility":2,"archive_timestamp":"2026-05-29T07:38:49+00:00"},{"url":"https://www.infosecurity-magazine.com/news/mastra-ai-supply-chain-attack/","name":"Microsoft Attributes Mastra AI Supply Chain Attack to North Korea (Infosecurity Magazine)","type":"news_article","archive_url":"http://web.archive.org/web/20260701064555/https://www.infosecurity-magazine.com/news/mastra-ai-supply-chain-attack/","credibility":2,"archive_timestamp":"2026-07-01T06:45:55+00:00"},{"url":"https://gbhackers.com/sapphire-sleet-hijacks-npm/","name":"Sapphire Sleet Hijacks npm Maintainer Account to Publish Poisoned Mastra Packages (GBHackers)","type":"news_article","archive_url":"https://web.archive.org/web/20260727100441/https://gbhackers.com/sapphire-sleet-hijacks-npm/","credibility":2,"archive_timestamp":"2026-07-27T10:04:41+00:00"},{"url":"https://www.theregister.com/2026/04/22/another_npm_supply_chain_attack/","name":"The Register: npm supply chain attack report (April 22, 2026)","type":"news_article","archive_url":"http://web.archive.org/web/20260502024744/https://www.theregister.com/2026/04/22/another_npm_supply_chain_attack/","credibility":2,"archive_timestamp":"2026-05-02T02:47:44+00:00"}],"source_tags":[],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-code-merge-writer","created_at":"2026-06-02T20:04:17.040278+00:00","updated_at":"2026-10-02T12:55:30.73865+00:00"},"source_quality":{"total":67,"tier1":0,"tier2":1,"tier3":0,"unrated":66},"follower_count":null,"content_updated_at":"2026-10-02T05:25:45.827Z","last_fact_checked_at":"2026-06-15T00:12:00.352Z","fact_check_next_allowed_at":null,"update_next_allowed_at":null}