TanStack, Mistral AI, UiPath Hit in Fresh Supply Chain Attack
Source SecurityWeek
Description
A coordinated supply chain attack dubbed Mini Shai-Hulud compromised over 170 packages across multiple high-profile NPM and PyPI projects, including TanStack, Mistral AI, and UiPath. The attackers, linked to the TeamPCP group, exploited three chained vulnerabilities in GitHub Actions workflows to publish malicious package versions with valid cryptographic provenance, making them appear legitimate. The injected payloads are multi-stage credential stealers targeting developer secrets, API keys, cloud credentials, and cryptocurrency wallets, with some variants also targeting password managers. The malware propagates by abusing GitHub OIDC tokens and commits itself to repositories to maintain persistence. The campaign published at least 401 malicious package artifacts within a five-hour window. Users are advised to audit their environments for affected package versions, rotate credentials, and review GitHub Actions configurations to mitigate risk.