Just when the JavaScript ecosystem was catching its breath after last week’s TanStack Router compromise, the Mini Shai-Hulud supply chain worm has continued its relentless march. Developed by the threat actor group TeamPCP, this highly sophisticated, self-propagating malware has already compromised over 300 npm packages and impacted tens of thousands of repositories as of May 2026.
The blast radius is expanding rapidly, making popular packages like echarts-for-react and @antv, alongside widely used GitHub Actions like actions-cool/issues-helper. The chaos has even reached OpenAI, forcing employees to regenerate code signing certificates, while Grafana faces blackmail from a connected ransomware group. While the Million.js repository was also briefly hit, they seemingly caught it in time before users were impacted.
Worse still, rumors are swirling that link this worm to the recent Nx Console VSCode extension compromise, and potentially a major GitHub internal repository breach.
Here is a breakdown of how this worm operates, why it is bypassing traditional defenses, and what your security team needs to do right now.
The Infection Chain: Bypassing SLSA Level 3
Historically, supply chain attacks relied heavily on stolen developer credentials or simple typosquatting. Mini Shai-Hulud represents a massive paradigm shift. It utilizes GitHub Actions workflow hijacking, cache poisoning, and OIDC (OpenID Connect) token extraction.
By manipulating the build environment directly, TeamPCP has managed to publish malicious updates that carry valid SLSA Build Level 3 attestations. Because these packages look completely legitimate and "verified" to standard automated security checks, they slide right past traditional gatekeepers.
Once a package is pulled down, the multi-stage attack unfolds:
The Runtime Smuggle: Triggered via a preinstall hook, the malware secretly downloads and executes the Bun JavaScript runtime. By running its malicious scripts through Bun rather than Node.js, it successfully evades most Node-specific security monitoring tools.
The Harvest: The worm immediately begins scraping the host environment (whether it's a developer's local machine or a CI/CD runner) for high-value targets, including GitHub tokens, AWS IAM keys, and cloud secrets.
Dead-Drop Exfiltration: The stolen data is encrypted and exfiltrated. Interestingly, the attackers frequently use public GitHub repositories, leveraging "dead-drop" commit messages to securely pass and harvest the stolen tokens without relying on a rigid command-and-control (C2) server.
Anatomy of the Worm
Exponential Self-Propagation
Once inside a runner or workstation, the worm checks the victim’s environment to see which other repositories and npm packages they have write access to. It automatically injects its malicious code into those upstream projects and republishes them, creating a compounding, automated web of infection.
Geofencing Evasion
To prolong its lifespan and avoid triggering the alarms of Eastern European cybercrime units, the malware features Russian locale geofencing. If it detects a specific regional signature on the host machine, it halts execution.
Deep Persistence
Mini Shai-Hulud doesn't just want to steal a token and leave; it wants to stay. It actively injects malicious hooks into VS Code configurations and Claude Code environments. Furthermore, it spins up background daemons (via systemd on Linux or LaunchAgents on macOS) to monitor if its stolen tokens get revoked—if they do, it attempts to trigger destructive fallback actions on the machine.
Expanding Scope
What began in April 2026 as a targeted campaign inside the SAP ecosystem has aggressively ballooned. In a matter of weeks, it has swallowed up major libraries tied to TanStack, Mistral AI, and UiPath, hitting at least 323 packages in the latest mid-May wave alone.
Incident Response: What Security Teams Must Do Now
If your organization utilizes modern JavaScript/TypeScript ecosystems, you must treat this as an active threat.
Step 1: Hunt for Indicators of Compromise (IoCs)
Audit developer workstations, CI/CD pipelines, and internal repositories for unauthorized workflow modifications. Specifically, security teams should hunt for unusual background daemons, unexpected outbound communication to arbitrary GitHub repositories, and the presence of the following persistence file: ~/.local/share/kitty/cat.py/
Step 2: Ruthless Secret Rotation
Because Mini Shai-Hulud’s primary objective is credential harvesting, assume any environment that touched a compromised package has been exposed. Immediately rotate:
GitHub personal access tokens (PATs) and SSH keys
AWS IAM keys and cloud service provider credentials
CI/CD secret variables and API keys
Step 3: Harden the Supply Chain
Moving forward, relying on basic package locks isn't enough. Security teams should enforce strict dependency allowlisting, mandate the generation and continuous auditing of Software Bills of Materials (SBOMs), implement strict network egress filtering on CI/CD runners, and heavily restrict the permissions granted to GitHub Actions tokens (contents: read by default, rather than global write access).
The scale of the TeamPCP campaign proves that supply chain security cannot be treated as a passive checklist. When a worm can mint its own valid SLSA attestations, the security boundary must move closer to the developer's actual environment.
