Mini Shai-Hulud Malware Hijacks AI Packages to Steal Developer Credentials
A supply chain attack that hijacked widely used AI and developer packages on npm and PyPI has been harvesting GitHub tokens, cloud API keys, and CI/CD secrets from thousands of developer machines. Security researchers call it the Mini Shai-Hulud campaign, and its footprint is still expanding. On May 12, 2026, attackers compromised the Mistral AI Python package and several TanStack JavaScript libraries, putting any application built on those open-source AI libraries at risk of silently pulling in malicious code.
Why does the Mini Shai-Hulud campaign matter?
Modern software runs on open-source code. Web applications, AI features, data pipelines, and developer tooling all pull from the same public registries that millions of developers trust. When one of those packages gets compromised, the malicious code flows straight into every project that depends on it.
The npm registry alone serves over 2 million packages, and a single popular frontend routing library like @tanstack/react-router records roughly 2 million weekly downloads, according to npm download statistics. Multiply that across several similar packages, and the campaign touched code that runs on tens of millions of developer machines. Anything built on the Mistral AI SDKs or the TanStack libraries was potentially in scope.
A compromised package can silently steal the tokens that authenticate an application to its services, the cloud storage where data lives, and even the GitHub repositories that hold source code. This is not a theoretical problem confined to back-end servers. It is a direct threat to the credentials that hold a software stack together.
What happened in the Mini Shai-Hulud attack?
On May 12, 2026, Microsoft Threat Intelligence announced it was investigating a compromised version of the mistralai PyPI package. The attackers had inserted malicious code into version 2.4.6 that executed the moment any Python program imported the library. That code quietly downloaded a secondary payload disguised as transformers.pyz from a remote server (IP 83.142.209.194) and launched it as a background process on Linux systems.
The payload functioned primarily as a credential stealer, but it also carried a destructive branch capable of running rm -rf / under certain geographic conditions. Researchers noted that the malware checked for Russian-language environments and would halt activity if it detected them, a common tactic in cybercriminal campaigns.
Within hours, security firm Aikido disclosed that the same campaign, dubbed Mini Shai-Hulud, had compromised multiple npm packages linked to the TanStack JavaScript ecosystem and the Mistral AI npm SDK. The affected list included @tanstack/react-router, @tanstack/history, @tanstack/router-core, @mistralai/mistralai, @mistralai/mistralai-azure, and @mistralai/mistralai-gcp, as detailed in Aikido’s incident report. Two attack waves began around 19:20 UTC on May 12.
The Mistral AI npm packages are direct SDKs that developers use to integrate large language models into applications. Any software drawing on Mistral’s models for text generation or analysis could have been running a compromised version without any visible change in behavior. The TanStack libraries power routing and history management in countless web dashboards. A backdoor in those dependencies gave attackers a path straight into the browser-based applications that depend on them.
When a trusted package turns malicious, the damage is not limited to one app. It spreads to every credential that app can reach.
What are the key numbers behind the attack?
- Tens of millions of weekly downloads across the affected TanStack packages, based on npm registry statistics.
- Three major registries hit: PyPI for the Python AI library, and npm for both frontend TanStack libraries and the official Mistral AI SDK packages.
- Two attack waves on npm on May 12, beginning around 19:20 UTC, plus the earlier PyPI compromise of
mistralaiv2.4.6. - Credential types at risk: GitHub personal access tokens, npm publish tokens, cloud API keys, CI/CD secrets, and SSH credentials.
- Country-aware destructive logic that refused to execute on Russian-language systems but could run
rm -rf /on other geographies, as flagged by Microsoft Threat Intelligence.
"Attackers injected code in mistralai/client/__init__.py that executes on import, downloads hxxps://83[.]142[.]209[.]194/transformers.pyz to /tmp/transformers.pyz, and launches a second-stage payload on Linux."
Microsoft Threat Intelligence, X, May 12, 2026
What comes next for the affected ecosystem?
Both Microsoft and Aikido stress that the investigation is active and more compromised packages may surface. Maintainers are auditing publishing infrastructure, and platform security teams are working to revoke tokens that may have been exfiltrated. The broader concern is that attackers who stole GitHub tokens or npm publish rights could use them to compromise additional packages in a cascading wave.
In the coming weeks, GitHub may force-token-reset events on maintainer accounts that show signs of compromise, which can briefly break CI for downstream users. The Python ecosystem will see renewed pressure to adopt signed-package distribution (Sigstore and PEP 740 are the leading proposals), much like npm’s mandatory 2FA for top maintainers after earlier supply-chain incidents. Security vendors will push harder on package allowlists and SBOM-based monitoring as a default guardrail for CI/CD runners, especially for teams shipping AI features that pull Mistral, OpenAI, and Anthropic SDKs.
What should developers and teams do now?
The Mini Shai-Hulud campaign is a reminder that every piece of software carries a supply chain, and most of it is invisible to the people who rely on the finished product. A single compromised dependency can leak the tokens and keys that hold an application together, often long before anyone notices a problem.
If you or your team installed any Mistral AI or TanStack npm packages, or the mistralai PyPI package, the practical steps are straightforward:
- Check your versions. Identify whether any affected package version, including
mistralaiv2.4.6, made it into your projects or build pipeline, and remove or downgrade it. - Rotate credentials. Treat any GitHub token, npm publish token, cloud API key, CI/CD secret, or SSH credential that the affected machines could reach as potentially exposed, and rotate it.
- Hunt for indicators. Look for
/tmp/transformers.pyz,pgmonitor.py, and apgsql-monitor.serviceunit, and block outbound connections to 83.142.209.194. Microsoft also recommends isolating affected Linux hosts. - Harden the pipeline. Enable automated dependency scanning, pin and verify package versions, and keep a software bill of materials so the next compromised dependency is caught quickly.
What is the bigger picture for software supply chains?
The Mini Shai-Hulud campaign is not a one-off. It is another ripple in the supply chain attack pattern that has already produced SolarWinds, 3CX, and the XZ Utils backdoor. This time, the target was the AI and developer tooling that a growing share of modern software depends on. That means almost any organization that ships software, or runs tools built on it, is now a node in the software supply chain. Visibility into dependencies, regular credential rotation, and verified package sources are no longer optional. They are the table stakes for keeping a software stack trustworthy.
FAQ
Which packages were compromised in the Mini Shai-Hulud attack?
The campaign hit the mistralai PyPI package (version 2.4.6), the Mistral AI npm SDKs (@mistralai/mistralai, @mistralai/mistralai-azure, @mistralai/mistralai-gcp), and several TanStack libraries: @tanstack/react-router, @tanstack/history, and @tanstack/router-core.
What credentials did the Mini Shai-Hulud malware steal?
The malware targeted GitHub personal access tokens, npm publish tokens, cloud API keys, CI/CD secrets, and SSH credentials that were reachable from machines running the compromised packages.
What is the immediate response if my project used an affected package?
Remove or downgrade the affected package version, rotate every potentially exposed GitHub token, npm credential, cloud API key, CI/CD secret, and SSH key, hunt for indicators such as /tmp/transformers.pyz, pgmonitor.py, and a pgsql-monitor.service unit, block outbound traffic to 83.142.209.194, and isolate affected Linux hosts as Microsoft recommends.