mini Shai-Hulud
Mini Shai-Hulud is a self-replicating software supply-chain malware family and open-source malware framework associated with the TeamPCP threat actor. Public reporting describes it as a worm and credential stealer that compromises developer and maintainer accounts, then propagates by publishing trojanized packages and abusing trusted developer workflows across ecosystems including npm and PyPI. TeamPCP publicly released the Mini Shai-Hulud toolkit/source code in 2026, after which multiple derivative and copycat campaigns were reported, including Miasma and Hades.
Across reporting, Mini Shai-Hulud and its descendants target developer workstations, CI/CD environments, GitHub repositories, GitHub Actions, package registries, and trusted publishing pipelines. The malware family is used to harvest secrets such as package registry tokens, GitHub tokens, SSH keys, cloud credentials, Kubernetes configurations, CI/CD secrets, and other developer credentials. Reporting also states that later variants expanded collection to cloud identities in Azure and GCP and targeted AI coding tool settings and repository configuration files.
Observed tradecraft linked to the Mini Shai-Hulud lineage includes malicious npm and PyPI packages, install-time execution via preinstall scripts and binding.gyp/node-gyp abuse, Bun-based JavaScript payload staging, obfuscated JavaScript loaders, GitHub dead-drop or exfiltration infrastructure, GitHub Actions secret theft, and direct source-repository compromise designed to trigger when repositories are opened in IDEs or AI coding assistants. Hades, a PyPI-focused variant, used .pth startup hooks, compiled .abi.so extensions, and Bun-delivered JavaScript stealers. Miasma, described as an evolved Mini Shai-Hulud variant, was reported in compromises affecting Red Hat npm packages, Microsoft repositories, LeoPlatform/RStreams npm packages, and a Go module tied to Verana Blockchain.
The family has been linked to large-scale package compromise activity, with reporting stating that Mini Shai-Hulud infected hundreds of open-source packages across multiple registries and that TeamPCP compromised more than 1,000 packages overall. High-confidence indicators and markers mentioned in reporting for related variants include public GitHub repository descriptions such as "Miasma: The Spreading Blight" and "Hades - The End for the Damned," workflow names such as "Run Copilot," and token-relay/dead-drop strings including "RevokeAndItGoesKaboom," "DontRevokeOrItGoesBoom," "TheBeautifulSandsOfTime," and "firedalazer." Attribution of some later campaigns remains uncertain because the Mini Shai-Hulud toolkit was publicly released and may be reused by copycats.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Vulnerabilities exploited
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
On 2026-05-27, CISA added three vulnerabilities to the KEV catalog, including CVE-2026-45321 (the TanStack / Mini Shai-Hulud tracking identifier) ... Treat the 2026-06-10 CISA remediation deadline for CVE-2026-45321 and CVE-2026-48027 as binding. | beginning 2026-06-01, a credential-stealing worm that Wiz named "Miasma" compromised dozens of @redhat-cloud-services packages... Vendors trace the malware to the TeamPCP lineage but now explicitly caution that a copycat using the public toolkit cannot be ruled out.
Groups observed using it
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Additionally, the group's objectives have grown as they have spread the use of Mini Shai-Hulud, a self-replicating malware strain that infected hundreds of open-source packages across multiple registries, and was then publicized to encourage imitations.
We have seen this in the past when Team PCP open sourced the Mini Shai-Hulud payload... We have been tracking TeamPCP, Mini Shai-Hulu, Miasma and other related campaigns.
TanStack npm packages compromised: inside the Mini Shai-Hulud supply chain attack ... The TanStack attack is not an isolated incident. It is the latest wave in a series of npm supply chain attacks using the Shai-Hulud worm toolchain.
Techniques & procedures
25 distinct techniques documented for this family, organized by ATT&CK tactic.
Resource Development
1 technique
Resource Development
Initial Access
7 techniques
Initial Access
If a simonecorsi-controlled workflow executed the compromised action with npm publishing credentials, GitHub tokens, or deployment permissions available to the runner, the attacker could have gained the access needed to publish malicious @immobiliarelabs package versions or trigger follow-on GitHub Actions activity.
The threat group has consistently evolved its tactics, developing payloads in JavaScript and Python while spreading from local files to Kubernetes application programming interfaces and bundled software development kits.
This appears to be a continuation of the activity we reported yesterday involving LeoPlatform and RStreams npm packages, GitHub Actions workflow abuse, AI-agent persistence, and the Verana Go module/source-repository compromise. The new ImmobiliareLabs activity follows the same broader campaign pattern: compromise trusted developer infrastructure, publish malicious package versions...
The malicious releases were published in a tight window on June 26, 2026... Multiple historical versions were republished with malicious artifacts, suggesting the threat actor attempted to maximize exposure across users pinned to older major versions.
Nx Console 18.95.0 — IDE Distribution Vector ... publish the malicious extension. ... IDE extensions = locally high-privilege code
Execution
2 techniques
Execution
Persistence
5 techniques
Persistence
If a simonecorsi-controlled workflow executed the compromised action with npm publishing credentials, GitHub tokens, or deployment permissions available to the runner, the attacker could have gained the access needed to publish malicious @immobiliarelabs package versions or trigger follow-on GitHub Actions activity.
The threat group has consistently evolved its tactics, developing payloads in JavaScript and Python while spreading from local files to Kubernetes application programming interfaces and bundled software development kits.
GitHub tokens can then be used to create repositories, upload encrypted data, modify workflows, poison source repositories, or prepare additional propagation paths. GitHub repository activity from services-admin-pearhealthlabs shows hundreds of public repositories with randomized names...
Privilege Escalation
4 techniques
Privilege Escalation
short-lived OIDC tokens were extracted from the memory of the Runner.Worker process... This attack shares the same TTPs as the 5/19 @antv wave: kitty-monitor, firedalazer, and extraction of Actions secrets from Runner /proc/*/mem .
If a simonecorsi-controlled workflow executed the compromised action with npm publishing credentials, GitHub tokens, or deployment permissions available to the runner, the attacker could have gained the access needed to publish malicious @immobiliarelabs package versions or trigger follow-on GitHub Actions activity.
Stealth
4 techniques
Stealth
Root index.js is a single-line Caesar-shift loader followed by AES-128-GCM decryption and multi-stage payload delivery.
short-lived OIDC tokens were extracted from the memory of the Runner.Worker process... This attack shares the same TTPs as the 5/19 @antv wave: kitty-monitor, firedalazer, and extraction of Actions secrets from Runner /proc/*/mem .
If a simonecorsi-controlled workflow executed the compromised action with npm publishing credentials, GitHub tokens, or deployment permissions available to the runner, the attacker could have gained the access needed to publish malicious @immobiliarelabs package versions or trigger follow-on GitHub Actions activity.
Defense Impairment
2 techniques
Defense Impairment
Credential Access
5 techniques
Credential Access
StepSecurity also reported that the payload targeted GitHub OIDC tokens, GitHub personal access tokens, and CI/CD secrets... Exfiltrates stolen secrets via the GitHub API to attacker-controlled repositories.
An Nx developer was compromised through the TanStack-related supply chain attack, resulting in the leakage of GitHub CLI (gh) credentials; ... harvesting GitHub / npm / AWS / Vault / K8s / 1Password / Claude Code configurations, etc.
Payload steals developer and CI/CD secrets: .env files, npm/PyPI/GitHub/Slack/Twilio/AWS/Azure/GCP/Vault tokens, SSH keys, Docker credentials, Kubernetes configs.
Lateral Movement
1 technique
Lateral Movement
Collection
1 technique
Collection
Command and Control
1 technique
Command and Control
IOCs tracked for this family
170 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
Recent activity
80 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Supply-chain malware targeting developer ecosystems. It steals developer and maintainer credentials, tokens, and secrets, abuses package registries and GitHub workflows, and propagates through trusted software development pipelines.
Related malware family linked by researchers to the broader Miasma threat cluster across multiple waves of software supply-chain attacks.
A self-replicating malware strain that infected hundreds of open-source packages across multiple registries to maximize downstream exposure and imitation.
A previously observed malicious npm package that used fake prompt-injection headers ahead of obfuscated JavaScript payloads to pollute AI-assisted review pipelines.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.