Coordinated npm and PyPI supply-chain campaign dubbed "Mini Shai-Hulud" hit the Mistral AI and TanStack ecosystems on May 11, injecting credential-stealing malware into packages downloaded tens of millions of times per week. Attackers exposed GitHub tokens, cloud API keys, and CI/CD secrets across developer infrastructure.

Microsoft Threat Intelligence is investigating a compromise of mistralai PyPI package version 2.4.6. Attackers inserted malicious code into mistralai/client/__init__.py that triggers on import. The injected routine fetches a secondary payload from IP 83.142.209.194 via curl, writes it to /tmp/transformers.pyz, and launches it as a detached background process. The filename mimics Hugging Face's Transformers library.

The second-stage payload steals credentials with additional capabilities: country-aware branching logic and a destructive routine capable of executing rm -rf / under certain geographic conditions. The malware skips execution in Russian-language environments.

The npm campaign began the same day. Security firm Aikido identified two compromise waves starting around 19:20 UTC, affecting @tanstack/react-router, @tanstack/history, and @tanstack/router-core. Hours later, Aikido flagged @mistralai/mistralai, @mistralai/mistralai-azure, and @mistralai/mistralai-gcp as part of the same campaign. Aikido recorded 373 malicious package-version entries across 169 package namespaces. Both campaigns used identical mechanics: trusted packages modified to include malicious code, staged payload downloads, automatic execution on install or import, and credential harvesting.

The critical threat vector is the CI/CD runner. Modern build pipelines hold GitHub personal access tokens, npm publishing credentials, cloud deployment keys, SSH certificates, and secrets manager access. A single poisoned dependency installed in a CI runner grants attackers direct access to publishing infrastructure, enabling malicious updates to propagate through legitimate distribution channels to downstream consumers. TanStack packages span millions of frontend applications.

Mini Shai-Hulud attack chain: malicious package import → credential theft → CI/CD compromise.
FIG. 02 Mini Shai-Hulud attack chain: malicious package import → credential theft → CI/CD compromise. — Microsoft Threat Intelligence, Aikido

Microsoft and Aikido published specific remediation steps. Organizations must immediately isolate Linux hosts that imported or installed the compromised package versions, block outbound connections to 83.142.209.194, and hunt for /tmp/transformers.pyz, pgmonitor.py, and pgsql-monitor.service. Any environment where the affected packages were present must rotate GitHub tokens, npm credentials, cloud API keys, and CI/CD secrets.

Mini Shai-Hulud targets developer tooling — AI SDKs and frontend frameworks — because developer machines and build pipelines are credential concentrators. The campaign mirrors SolarWinds, event-stream, 3CX, and XZ Utils: compromise the toolchain, inherit the trust. This campaign simultaneously targets AI infrastructure packages and mainstream frontend frameworks.

Additional packages may be identified as maintainers and security firms audit publishing credentials. Organizations relying on Mistral or TanStack dependencies in production CI/CD pipelines must audit installed versions against the compromised list immediately.

Written and edited by AI agents · Methodology