NewsCompaniesFlawsGuides
Get the app
CriticalPartly fixedClosedUpdated

Mini Shai-Hulud poisons TanStack, Mistral and other packages; TanStack CVE-2026-45321

TeamPCP poisoned more than 160 developer packages to steal credentials. Affected developers need clean packages, machine recovery and replacement secrets. Mac users should install current OpenAI apps following precautionary certificate changes.

What to do

If you use OpenAI's ChatGPT, Codex or Atlas on a Mac, install the current version through its built-in updater or official website. If you or your family business develops software, ask your IT team to check dependency records and build machines against the affected-package advisories. For an infected machine, have specialists remove persistence, including the token-monitor process, before replacing exposed credentials: Wiz warns that token revocation could trigger file deletion.

What’s happening

Beginning on 11 May, attackers used TanStack's automated build infrastructure to publish credential-stealing software under trusted package names. CERT-EU recorded more than 160 compromised npm and PyPI packages, including projects associated with Mistral AI, UiPath and OpenSearch. Wiz attributes the campaign to TeamPCP and reports password-vault collection and file-deletion attempts in some payloads. Developers and automated build systems were directly exposed. Mistral confirmed that its poisoned Python package stole credentials, while its npm malware could not run. Clean TanStack releases are available, and Mistral withdrew its malicious releases and closed its investigation. Campaign-wide fixed-release coverage is not established by the reviewed advisories, so remediation is recorded as partial. Updating alone does not recover stolen secrets or clean infected machines. OpenAI confirmed two employee-device infections, found no evidence of customer-data compromise and required precautionary Mac app updates. September claims of another Mistral breach remained unsubstantiated.

What
Poisoned software
Affects
TanStack Router and Start, Mistral AI SDKs, and other npm and PyPI developer packages
Affected
TanStack: 84 malicious versions across 42 Router/Start npm packages; the complete package-specific table is in GHSA-g7cv-rxg3-hmpx.
@tanstack/react-router, @tanstack/solid-router, @tanstack/vue-router and @tanstack/router-core: 1.169.5 and 1.169.8
@tanstack/react-start: 1.167.68 and 1.167.71
@tanstack/solid-start: 1.167.65 and 1.167.68
@tanstack/vue-start: 1.167.61 and 1.167.64
@tanstack/history: 1.161.9 and 1.161.12
@mistralai/mistralai (npm): 2.2.2, 2.2.3 and 2.2.4
@mistralai/mistralai-azure (npm): 1.7.1, 1.7.2 and 1.7.3
@mistralai/mistralai-gcp (npm): 1.7.1, 1.7.2 and 1.7.3
mistralai (PyPI): 2.4.6
Fixed in
@tanstack/react-router, @tanstack/solid-router, @tanstack/vue-router and @tanstack/router-core: 1.169.9
@tanstack/react-start: 1.167.72
@tanstack/solid-start: 1.167.69
@tanstack/vue-start: 1.167.65
@tanstack/history: 1.161.13
Other TanStack packages have individual clean versions listed in GHSA-g7cv-rxg3-hmpx; TanStack confirmed all registry-available versions safe on 15 May.
Mistral withdrew the listed malicious versions; its advisory says earlier versions are unaffected but does not name replacement release numbers.
CVE
CVE-2026-45321
Since
11 May 2026
Closed
22 Sept 2026

Timeline

  1. Update

    TechRadar reported renewed claims that Mistral source code was for sale. Mistral said it found no evidence of a new breach; whether the advertised material came from May remained unconfirmed.

  2. Update

    CERT-EU's May review recorded more than 160 compromised npm and PyPI packages associated with TanStack, Mistral AI, UiPath and OpenSearch. It reported that packages had been withdrawn and credentials rotated.

  3. All clear

    TanStack issued an all-clear after its security review, saying every package version still available from the registry was safe to install. This covered its packages, not machines previously infected.

  4. Vendor revised

    Mistral closed its investigation, reporting no impact on its global infrastructure. It confirmed that its npm malware could not execute, while the Python package harvested credentials when imported.

  5. Update

    Wiz revised its analysis: the poisoned Mistral and UiPath npm payloads could not run because of a bug. Separately, researchers observed an updated Python payload that corrected a fault in its file-deletion functionality.

  6. Update

    OpenAI disclosed infections on two employee devices and theft of limited credential material. Exposed repositories included app-signing certificates, prompting certificate replacement and required Mac app updates; its amended notice extended the update deadline to 26 June.

  7. Update

    Mistral disclosed poisoned JavaScript and Python SDK releases. Its malicious npm versions were removed by approximately 01:00 UTC and Python version 2.4.6 by approximately 03:00 UTC.

  8. Made publicPartly fixed

    StepSecurity reported malicious TanStack packages after attackers published 84 poisoned versions across 42 packages between 19:20 and 19:26 UTC. TanStack says npm removed the affected downloads that evening.

Sources

  1. Malware in 42 @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keysTanStack · 11 May 2026
  2. Postmortem: TanStack npm supply-chain compromiseTanStack · 15 May 2026
  3. TanStack supply chain attack affecting Mistral SDK packagesMistral AI · 14 May 2026
  4. Our response to the TanStack npm supply chain attackOpenAI · 13 May 2026
  5. Mini Shai-Hulud Strikes Again: TanStack + more npm Packages CompromisedWiz · 12 May 2026
  6. Cyber Brief 26-06 - May 2026CERT-EU · 2 June 2026
  7. Mistral denies a fresh security breach, but the code on sale looks a lot like May's leakTechRadar · 22 Sept 2026
HARD Live follows this until it’s over: each change is added to the timeline with its source. Everything live · Everything from May 2026 · JSON · RSS