Mini Shai-Hulud Worm Compromises TanStack, Mistral AI, Guardrails AI & More Packages
· Source: thehackernews.com
In short
A sophisticated supply chain attack dubbed 'Mini Shai-Hulud' has compromised multiple npm and PyPI packages from TanStack, Mistral AI, Guardrails AI, UiPath, OpenSearch, and others. The worm leverages hijacked OIDC tokens and trusted CI/CD publishing workflows to spread, installing credential stealers targeting cloud providers, crypto wallets, AI tools, and CI systems, while carrying valid SLSA provenance attestations.
Read Original Article — Read the full article on the publisher’s site.
In the issue of week 20, 2026: AI-Powered Automation and Control Towers Drive Supply Chain Transformation
Tags: supply chain, malware, npm, PyPI, credential theft, GitHub Actions