# mini-shai-hulud-170-npm-pypi-packages-compromised-in-coordinated: "Mini Shai-Hulud": 170+ npm/PyPI Packages Compromised in Coordinated TanStack/Mistral/UiPath Attack

> "Mini Shai-Hulud": 170+ npm/PyPI Packages Compromised in Coordinated TanStack/Mistral/UiPath Attack is a critical-severity supply chain compromise issue in TanStack @tanstack/*, an AI agent. Affected: TanStack @tanstack/* (84 versions), mistralai (npm + PyPI), UiPath npm suite, opensearch, guardrails-ai. It has been exploited in the wild.

- **Canonical URL:** https://catalog.anomity.ai/vuln/mini-shai-hulud-170-npm-pypi-packages-compromised-in-coordinated
- **Aliases:** ti-022
- **Severity:** critical
- **Attack type:** Supply chain compromise, Credential theft, Malware
- **Component:** TanStack @tanstack/* (AI agent)
- **Exploited in the wild:** yes
- **Published:** 2026-05-11
- **Last verified:** 2026-11-01
- **JSON:** https://catalog.anomity.ai/api/entries/vuln/mini-shai-hulud-170-npm-pypi-packages-compromised-in-coordinated

## Summary

A coordinated supply chain attack by the TeamPCP extortion gang published 404 malicious versions across 170+ npm and PyPI packages on May 11, hitting the entire TanStack router ecosystem (42 packages, including reach into OpenAI's tooling), Mistral AI's SDK suite, UiPath's automation tooling (65 packages), OpenSearch (1.3M weekly downloads), and Guardrails AI. The payload silently harvests 90+ categories of secrets including Claude AI and Kiro IDE configs, AWS/Azure/GCP credentials, GitHub tokens, and .env files.

## Affected versions

| Affected | Fixed in |
| --- | --- |
| TanStack @tanstack/* (84 versions), mistralai (npm + PyPI), UiPath npm suite, opensearch, guardrails-ai | no fixed version listed |

## Am I affected by this vulnerability?

You are affected if you run TanStack @tanstack/* (84 versions), mistralai (npm + PyPI), UiPath npm suite, opensearch, guardrails-ai.

## How do I fix it?

Pin and audit lockfiles for any of the named package families published May 11–12. Rotate Claude AI, Kiro, AWS/Azure/GCP, GitHub, and npm tokens harvested from developer machines. Enable npm 2FA + token scoping. Hunt for credential-stealer indicators on developer workstations and CI runners.

## How do I find every machine running TanStack @tanstack/*?

Anomity inventories the AI agents, MCP servers, IDE extensions and skills on each developer device, so you can see which machines run TanStack @tanstack/* and which version, then enforce a policy on it.

## References

- article: https://www.wiz.io/blog/mini-shai-hulud-strikes-again-tanstack-more-npm-packages-compromised

## Related vulnerabilities

- [mandiant-hijacked-ai-coding-assistant-session-deploys-shai-hulud-across](https://catalog.anomity.ai/vuln/mandiant-hijacked-ai-coding-assistant-session-deploys-shai-hulud-across) — critical
- [keyv-cacheable-npm-worm-writes-auto-run-hooks-into-claude-settings-json](https://catalog.anomity.ai/vuln/keyv-cacheable-npm-worm-writes-auto-run-hooks-into-claude-settings-json) — critical
- [asyncapi-npm-packages-backdoored-with-miasma-malware-framework](https://catalog.anomity.ai/vuln/asyncapi-npm-packages-backdoored-with-miasma-malware-framework) — critical
- [self-propagating-npm-supply-chain-worm-targets-ai-agent-packages](https://catalog.anomity.ai/vuln/self-propagating-npm-supply-chain-worm-targets-ai-agent-packages) — critical
- [litellm-1-107-0-compromised-on-pypi-and-docker-a-cook-pth-startup-hook](https://catalog.anomity.ai/vuln/litellm-1-107-0-compromised-on-pypi-and-docker-a-cook-pth-startup-hook) — critical
- [symantec-the-aoki-infostealer-now-takes-claude-codex-cursor-copilot](https://catalog.anomity.ai/vuln/symantec-the-aoki-infostealer-now-takes-claude-codex-cursor-copilot) — high

---

Source: Anomity Security Database (https://catalog.anomity.ai/vuln). Detect affected AI tools on developer devices: https://anomity.ai/?utm_source=catalog&utm_medium=vuln-md&utm_campaign=mini-shai-hulud-170-npm-pypi-packages-compromised-in-coordinated