{"id":"mini-shai-hulud-package-poisoning-may-2026","category":"supply-chain","status":"closed","title":"Mini Shai-Hulud poisons TanStack, Mistral and other packages; TanStack CVE-2026-45321","tldr":"TeamPCP poisoned more than 160 developer packages to steal credentials. Affected developers need clean packages, machine recovery and replacement secrets. Mac users should install current OpenAI apps following precautionary certificate changes.","summary":"Beginning on 11 May, attackers used TanStack's automated build infrastructure to publish credential-stealing software under trusted package names. CERT-EU recorded more than 160 compromised npm and PyPI packages, including projects associated with Mistral AI, UiPath and OpenSearch. Wiz attributes the campaign to TeamPCP and reports password-vault collection and file-deletion attempts in some payloads. Developers and automated build systems were directly exposed. Mistral confirmed that its poisoned Python package stole credentials, while its npm malware could not run. Clean TanStack releases are available, and Mistral withdrew its malicious releases and closed its investigation. Campaign-wide fixed-release coverage is not established by the reviewed advisories, so remediation is recorded as partial. Updating alone does not recover stolen secrets or clean infected machines. OpenAI confirmed two employee-device infections, found no evidence of customer-data compromise and required precautionary Mac app updates. September claims of another Mistral breach remained unsubstantiated.","action":"If you use OpenAI's ChatGPT, Codex or Atlas on a Mac, install the current version through its built-in updater or official website. If you or your family business develops software, ask your IT team to check dependency records and build machines against the affected-package advisories. For an infected machine, have specialists remove persistence, including the token-monitor process, before replacing exposed credentials: Wiz warns that token revocation could trigger file deletion.","product":"TanStack Router and Start, Mistral AI SDKs, and other npm and PyPI developer packages","audience":"both","severity":"critical","patch":"partial","exploited":true,"cves":["CVE-2026-45321"],"tags":["tanstack","mistral","npm","pypi","supply-chain","credential-theft","mini-shai-hulud"],"affected":["TanStack: 84 malicious versions across 42 Router/Start npm packages; the complete package-specific table is in GHSA-g7cv-rxg3-hmpx.","@tanstack/react-router, @tanstack/solid-router, @tanstack/vue-router and @tanstack/router-core: 1.169.5 and 1.169.8","@tanstack/react-start: 1.167.68 and 1.167.71","@tanstack/solid-start: 1.167.65 and 1.167.68","@tanstack/vue-start: 1.167.61 and 1.167.64","@tanstack/history: 1.161.9 and 1.161.12","@mistralai/mistralai (npm): 2.2.2, 2.2.3 and 2.2.4","@mistralai/mistralai-azure (npm): 1.7.1, 1.7.2 and 1.7.3","@mistralai/mistralai-gcp (npm): 1.7.1, 1.7.2 and 1.7.3","mistralai (PyPI): 2.4.6"],"fixed":["@tanstack/react-router, @tanstack/solid-router, @tanstack/vue-router and @tanstack/router-core: 1.169.9","@tanstack/react-start: 1.167.72","@tanstack/solid-start: 1.167.69","@tanstack/vue-start: 1.167.65","@tanstack/history: 1.161.13","Other TanStack packages have individual clean versions listed in GHSA-g7cv-rxg3-hmpx; TanStack confirmed all registry-available versions safe on 15 May.","Mistral withdrew the listed malicious versions; its advisory says earlier versions are unaffected but does not name replacement release numbers."],"matches":[],"sources":[{"kind":"advisory","title":"Malware in 42 @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys","url":"https://github.com/TanStack/router/security/advisories/GHSA-g7cv-rxg3-hmpx","by":"TanStack","date":"2026-05-11"},{"kind":"advisory","title":"Postmortem: TanStack npm supply-chain compromise","url":"https://tanstack.com/blog/npm-supply-chain-compromise-postmortem","by":"TanStack","date":"2026-05-15"},{"kind":"advisory","title":"TanStack supply chain attack affecting Mistral SDK packages","url":"https://docs.mistral.ai/resources/security-advisories/MAI-2026-002","by":"Mistral AI","date":"2026-05-14"},{"kind":"advisory","title":"Our response to the TanStack npm supply chain attack","url":"https://openai.com/index/our-response-to-the-tanstack-npm-supply-chain-attack/","by":"OpenAI","date":"2026-05-13"},{"kind":"research","title":"Mini Shai-Hulud Strikes Again: TanStack + more npm Packages Compromised","url":"https://www.wiz.io/blog/mini-shai-hulud-strikes-again-tanstack-more-npm-packages-compromised","by":"Wiz","date":"2026-05-12"},{"kind":"research","title":"Cyber Brief 26-06 - May 2026","url":"https://cert.europa.eu/publications/threat-intelligence/cb26-06","by":"CERT-EU","date":"2026-06-02"},{"kind":"news","title":"Mistral denies a fresh security breach, but the code on sale looks a lot like May's leak","url":"https://www.techradar.com/pro/security/mistral-denies-a-fresh-security-breach-but-the-code-on-sale-looks-a-lot-like-mays-leak","by":"TechRadar","date":"2026-09-22"}],"started":"2026-05-11","closed":"2026-09-22","created":"2026-11-03T21:21:01.665Z","updated":"2026-11-03T21:21:01.665Z","cve_notes":[{"cve":"CVE-2026-45321","name":"Malicious releases in TanStack Router and Start","what":"A compromise of TanStack's build infrastructure let attackers publish 84 malicious npm versions across 42 Router and Start packages that stole credentials during installation and spread to other packages.","severity":"critical","cvss":9.6}],"timeline":[{"at":"2026-09-22","added":"2026-11-03T21:16:05.524Z","kind":"other","text":"TechRadar reported renewed claims that Mistral source code was for sale. Mistral said it found no evidence of a new breach; whether the advertised material came from May remained unconfirmed.","url":"https://www.techradar.com/pro/security/mistral-denies-a-fresh-security-breach-but-the-code-on-sale-looks-a-lot-like-mays-leak","by":"TechRadar","patch":null},{"at":"2026-06-02","added":"2026-11-03T21:16:05.524Z","kind":"other","text":"CERT-EU's May review recorded more than 160 compromised npm and PyPI packages associated with TanStack, Mistral AI, UiPath and OpenSearch. It reported that packages had been withdrawn and credentials rotated.","url":"https://cert.europa.eu/publications/threat-intelligence/cb26-06","by":"CERT-EU","patch":null},{"at":"2026-05-15","added":"2026-11-03T21:16:05.524Z","kind":"all-clear","text":"TanStack issued an all-clear after its security review, saying every package version still available from the registry was safe to install. This covered its packages, not machines previously infected.","url":"https://tanstack.com/blog/npm-supply-chain-compromise-postmortem","by":"TanStack","patch":null},{"at":"2026-05-14","added":"2026-11-03T21:16:05.524Z","kind":"vendor-revised","text":"Mistral closed its investigation, reporting no impact on its global infrastructure. It confirmed that its npm malware could not execute, while the Python package harvested credentials when imported.","url":"https://docs.mistral.ai/resources/security-advisories/MAI-2026-002","by":"Mistral AI","patch":null},{"at":"2026-05-13T02:30Z","added":"2026-11-03T21:16:05.524Z","kind":"other","text":"Wiz revised its analysis: the poisoned Mistral and UiPath npm payloads could not run because of a bug. Separately, researchers observed an updated Python payload that corrected a fault in its file-deletion functionality.","url":"https://www.wiz.io/blog/mini-shai-hulud-strikes-again-tanstack-more-npm-packages-compromised","by":"Wiz","patch":null},{"at":"2026-05-13","added":"2026-11-03T21:16:05.524Z","kind":"other","text":"OpenAI disclosed infections on two employee devices and theft of limited credential material. Exposed repositories included app-signing certificates, prompting certificate replacement and required Mac app updates; its amended notice extended the update deadline to 26 June.","url":"https://openai.com/index/our-response-to-the-tanstack-npm-supply-chain-attack/","by":"OpenAI","patch":null},{"at":"2026-05-12","added":"2026-11-03T21:16:05.524Z","kind":"other","text":"Mistral disclosed poisoned JavaScript and Python SDK releases. Its malicious npm versions were removed by approximately 01:00 UTC and Python version 2.4.6 by approximately 03:00 UTC.","url":"https://docs.mistral.ai/resources/security-advisories/MAI-2026-002","by":"Mistral AI","patch":null},{"at":"2026-05-11T19:46Z","added":"2026-11-03T21:16:05.524Z","kind":"disclosed","text":"StepSecurity reported malicious TanStack packages after attackers published 84 poisoned versions across 42 packages between 19:20 and 19:26 UTC. TanStack says npm removed the affected downloads that evening.","url":"https://tanstack.com/blog/npm-supply-chain-compromise-postmortem","by":"TanStack","patch":"partial"}],"url":"https://hard.fyi/live/mini-shai-hulud-package-poisoning-may-2026/","json":"https://hard.fyi/api/live?id=mini-shai-hulud-package-poisoning-may-2026"}