Loading malware…
Mini Shai-Hulud is a self-propagating software supply-chain malware family that targets open-source package ecosystems, developer workstations, and CI/CD environments. It is best characterized as a credential-stealing worm that spreads by abusing stolen maintainer and automation credentials to publish trojanized package releases through legitimate repositories and trusted build pipelines. The malware has been associated with TeamPCP-linked activity, and multiple derivative campaigns and variants have been tracked under names including ChainDrop and Miasma.
The malware is primarily known for compromising npm and, in some reporting, PyPI package supply chains. Infected packages execute malicious code automatically during installation, commonly through package lifecycle hooks such as preinstall, though related variants have also used alternative execution paths such as build-related metadata or import-time execution. Recent variants have used the Bun runtime to launch heavily obfuscated second-stage JavaScript payloads. Once running, Mini Shai-Hulud harvests credentials and secrets from local configuration files, environment variables, shell history, CI runner contexts, and process memory. Targeted material includes npm publishing tokens, GitHub credentials and workflow tokens, cloud-provider credentials, Kubernetes and Vault secrets, SSH material, and other developer or infrastructure access tokens. Some variants also target AI-tool configuration data and cryptocurrency wallets.
A defining feature of Mini Shai-Hulud is autonomous propagation. When valid publishing credentials are found, the malware enumerates accessible packages, modifies package contents to insert its loader and payload, updates package metadata or lifecycle behavior, increments versions, and republishes malicious releases under the victim’s identity. In some campaigns it also abused trusted publishing workflows and OIDC-based release automation, allowing malicious packages to be published with valid provenance attestations despite containing malware. This makes the family notable not only for credential theft but also for weaponizing legitimate software release infrastructure.
Mini Shai-Hulud also establishes persistence in developer environments. Observed variants modify configuration files used by Visual Studio Code and AI coding assistants such as Claude Code, Gemini CLI, Cursor, and GitHub Copilot so that the malware can re-execute when a project is opened or an AI-assisted coding session begins. This extends the infection path beyond package installation and turns trusted developer tooling into a persistence and propagation layer.
Exfiltration behavior includes encrypting stolen data before transmission and using multiple channels for resilience. Observed campaigns have used attacker-controlled repositories created with stolen code-hosting credentials, as well as blockchain-backed dead-drop or EtherHiding-style mechanisms to retrieve fallback infrastructure. Some variants include dead-man’s-switch logic tied to the validity of stolen tokens, and reporting on later waves describes destructive behavior on selected systems, including disk-wipe functionality under certain locale conditions.
Mini Shai-Hulud has affected widely used packages and foundational dependencies, creating downstream risk for software publishers, enterprises, cloud environments, and production release pipelines. Its operational pattern combines credential theft, supply-chain compromise, persistence in developer tooling, and worm-like republishing at ecosystem scale, making it one of the more consequential malware families targeting modern software development infrastructure.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
4 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
The tracking identifier is CVE-2026-45321 (CVSS 9.6 per The Hacker News; advisory GHSA-g7cv-rxg3-hmpx per Snyk). | a new self-spreading Mini Shai-Hulud worm across npm and PyPI... poisoned roughly 170 npm and PyPI packages... plus a 1-in-6 disk-wipe payload on Israeli and Iranian locale hosts.
The four CVEs associated with this campaign are CVE-2026-33634, CVE-2026-48027, CVE-2026-45321, and CVE-2025-55182. | Mini Shai-Hulud was a self-replicating worm designed to spread across both npm and PyPI registries.
The four CVEs associated with this campaign are CVE-2026-33634, CVE-2026-48027, CVE-2026-45321, and CVE-2025-55182. | Mini Shai-Hulud was a self-replicating worm designed to spread across both npm and PyPI registries.
The four CVEs associated with this campaign are CVE-2026-33634, CVE-2026-48027, CVE-2026-45321, and CVE-2025-55182. | Mini Shai-Hulud was a self-replicating worm designed to spread across both npm and PyPI registries.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
TanStack npm packages compromised: inside the Mini Shai-Hulud supply chain attack ... The TanStack attack is not an isolated incident. It is the latest wave in a series of npm supply chain attacks using the Shai-Hulud worm toolchain.
26 distinct techniques documented for this family, organized by ATT&CK tactic.
Multiple npm packages in the keyv / cacheable ecosystem were compromised following the compromise of a GitHub maintainer account
It uses recovered identities to authenticate to NPM, GitHub, Amazon Web Services (AWS), Kubernetes, and HashiCorp Vault
The attacker compromised the GitHub account of the maintainer of the keyv ecosystem, injecting malicious code into the source repository. This caused the project’s own GitHub Actions-based release pipeline to build and publish poisoned versions of packages including keyv, cacheable, flat-cache, and file-entry-cache.
The C2 can respond with a code value that can specify a command to arm the dead-man switch
The malicious releases contain a Mini Shai-Hulud variant, a self-propagating credential-stealing worm delivered through a large, heavily obfuscated Bun-based JavaScript payload.
When it found an active npm publishing token, it downloaded the latest version of every package the account could access, injected a malicious preinstall lifecycle hook... Because npm runs preinstall hooks automatically before installation finishes, the malware could start running on developer workstations and CI runners before application tests or security checks began.
Multiple npm packages in the keyv / cacheable ecosystem were compromised following the compromise of a GitHub maintainer account
Multiple npm packages in the keyv / cacheable ecosystem were compromised following the compromise of a GitHub maintainer account
deletes its state and exits if the token stops working. It also self-clears after 24 hours
Multiple npm packages in the keyv / cacheable ecosystem were compromised following the compromise of a GitHub maintainer account
It uses recovered identities to authenticate to NPM, GitHub, Amazon Web Services (AWS), Kubernetes, and HashiCorp Vault
When it found an active npm publishing token, it downloaded the latest version of every package the account could access, injected a malicious preinstall lifecycle hook... Because npm runs preinstall hooks automatically before installation finishes, the malware could start running on developer workstations and CI runners before application tests or security checks began.
Once inside, the worm searched developer machines and CI environments for any other credentials it could use. When it found an active npm publishing token...
The malware can also use stolen GitHub credentials to inject Claude and Visual Studio Code configuration files into repositories, establishing persistence and creating an additional developer-to-developer infection path.
In CI environments, it stayed connected to the active job, where it could reach workflow secrets, runner credentials, and publishing permissions.
AADInternals can gather unsecured credentials for Azure AD services, such as Azure AD Connect, from a local machine... Agent Tesla has the ability to extract credentials from configuration or support files... APT33 has used a variety of publicly available tools like LaZagne to gather credentials.
The stolen information is sent out of the victim environment, after which publishing access is used to alter package archives, raise their version numbers, and release them again.
216 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
109 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An earlier Shai-Hulud campaign variant focused on software supply-chain propagation through package ecosystems, retaining the core worm capabilities with narrower targeting before later expansion.
Referenced as the malware family from which ChainDrop is described as a new variant in this npm supply chain campaign.
A credential-stealing worm used in an npm supply-chain attack. It spreads via stolen maintainer credentials, searches developer machines and CI environments for additional credentials and npm publishing tokens, injects malicious preinstall hooks into accessible packages, republishes infected versions, and can access workflow secrets, runner credentials, and publishing permissions.
A self-spreading npm supply-chain malware campaign that compromises trusted package maintainer accounts, steals access tokens and other secrets from victim environments, exfiltrates them, and uses the stolen publishing credentials to push additional malicious package releases across the npm ecosystem.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.