Mini Shai-Hulud Supply Chain Attack — IOC Checker

curl -fsSL https://raw.githubusercontent.com/nkopylov/tanscript-exploit-check/main/check-tanstack-exploit.sh | bash

Or clone and run locally:

git clone https://github.com/nkopylov/tanscript-exploit-check.git
cd tanscript-exploit-check
./check-tanstack-exploit.sh [project_dir ...]

What happened

This checker covers two waves of the Mini Shai-Hulud supply chain attack campaign by TeamPCP:

Wave 1: TanStack CI/CD Compromise (May 11, 2026)

On May 11, 2026 (19:20-19:26 UTC), an attacker published 84 malicious versions across 42 @tanstack/* npm packages in a 6-minute window. The attack also hit packages from Mistral AI, UiPath, OpenSearch, and others — over 170 packages total across npm and PyPI.

No maintainer credentials were stolen. The attacker exploited the CI/CD trust chain itself via a 3-stage attack:

1. pull_request_target exploit — A throwaway GitHub fork opened a PR that ran attacker code in the base repo's security context
2. GitHub Actions cache poisoning — The fork's code poisoned the shared pnpm cache, which later infected legitimate release workflows
3. OIDC token extraction from process memory — The malicious code extracted npm publish tokens directly from the GitHub Actions runner's memory, producing packages with valid SLSA Build Level 3 provenance attestations

Wave 2: "atool" npm Account Takeover (May 19, 2026)

On May 19, 2026 (01:39-02:06 UTC), the compromised atool npm account ([email protected]) published 637 malicious versions across 314 packages in two automated waves. High-impact targets include:

• size-sensor (4.2M downloads/month)
• echarts-for-react (3.8M downloads/month)
• @antv/scale (2.2M downloads/month)
• timeago.js (1.15M downloads/month)
• 310+ additional @antv/* and other packages

This wave used a Bun-based payload (498KB index.js) triggered via "preinstall": "bun run index.js", with a second-stage payload hidden in imposter commits pushed to the antvis/G2 GitHub repo via the fork object sharing exploit.

What the malicious code does (both waves)

Both waves use the same "Mini Shai-Hulud" toolkit family:

• Credential harvesting: 80+ env vars, AWS full chain (env → config → IMDSv2 → ECS → Secrets Manager), GitHub PATs, npm tokens, SSH keys, K8s tokens, Vault tokens, password managers (1Password, Bitwarden, pass, gopass)
• Persistence: gh-token-monitor (Wave 1) and kitty-monitor (Wave 2) daemons via LaunchAgent/systemd; hooks in .claude/settings.json and .vscode/tasks.json
• Exfiltration: P2P networks (Wave 1), GitHub Git Data API + HTTPS disguised as OpenTelemetry traces (Wave 2)
• CI/CD abuse: Workflow injection dumping toJSON(secrets), npm OIDC token exchange
• Dead-man's switch: rm -rf ~/ if GitHub token revoked while daemon active
• Dead-drop C2 (Wave 2): Polls GitHub commit search API for firedalazer keyword, RSA-PSS signed commands

What this script checks

Affected packages

Wave 1: TanStack (42 packages)

Only @tanstack/router* and @tanstack/start* were affected. NOT affected: @tanstack/query*, @tanstack/table*, @tanstack/form*, @tanstack/virtual*, @tanstack/store.

See the full advisory for all 42 packages.

Wave 2: atool account (314 packages)

All packages published by npm user atool ([email protected]) received malicious versions on May 19, 2026. High-impact packages include:

Plus 310+ packages primarily in the @antv/* scope (@antv/g2, @antv/g6, @antv/l7, @antv/s2, @antv/x6, @antv/f2, etc.), ai-figure, timeago-react, jest-canvas-mock, jest-date-mock, and others.

See the SafeDep writeup for the full list.

Remediation (if compromised)

CRITICAL: Disable the dead-man's switch BEFORE revoking any tokens. The malware wipes $HOME if tokens are revoked while the daemon is active.

1. Kill persistence daemons (gh-token-monitor AND kitty-monitor) and remove LaunchAgent/systemd services
2. Remove persistence files (.claude/router_runtime.js, .vscode/setup.mjs, ~/.local/share/kitty/cat.py, /var/tmp/.gh_update_state, etc.)
3. Delete node_modules and lockfiles, reinstall with --ignore-scripts
4. Rotate ALL credentials (npm, GitHub, AWS, GCP, SSH keys, Vault tokens, password manager tokens, etc.)
5. Block attacker domains at DNS/firewall level (api.masscan.cloud, filev2.getsession.org, git-tanstack.com, t.m-kosche.com)
6. Audit cloud provider logs for May 11-19, 2026

Official announcements and references

Wave 1: TanStack (May 11)

• CVE-2026-45321 (CVSS 9.6 Critical) — CVE Record
• GHSA-g7cv-rxg3-hmpx — GitHub Advisory
• TanStack Postmortem — tanstack.com/blog/npm-supply-chain-compromise-postmortem
• TanStack Hardening Follow-up — tanstack.com/blog/incident-followup
• GitHub Tracking Issue — TanStack/router#7383

Wave 2: atool account takeover (May 19)

• SafeDep Analysis — safedep.io/mini-shai-hulud-strikes-again-314-npm-packages-compromised

Security researcher write-ups

• Socket.dev
• Snyk
• StepSecurity (original discoverers)
• Wiz
• Orca Security
• SecurityWeek

Hardening prompts for AI coding agents

Copy-paste these prompts into your AI coding agent (Claude Code, Cursor, Cline/OpenClaw, Windsurf, Hermes, etc.) to harden your project against supply chain attacks like this one.

Prompt 1: npm publish delay (quarantine new versions)

Harden this project's npm configuration against supply chain attacks. Do the following:

1. Pin exact versions: Remove all ^ and ~ prefixes from every dependency in package.json so that npm install never silently pulls a newly published version.

2. Disable postinstall scripts by default: Add ignore-scripts=true to .npmrc. Then add an explicit "preinstall" script in package.json that runs only the known-safe lifecycle scripts this project actually needs (if any).

3. Enforce lockfile-only installs in CI: Make sure CI uses npm ci (not npm install). If there's a CI config file, verify this. If not, note it as a manual step.

4. Add provenance verification: Add npm audit signatures as a step in the CI pipeline and as a pre-push git hook.

Prompt 2: Harden AI agent configuration

Audit and harden this project's AI coding agent configuration against supply chain injection attacks (like the TanStack/Mini Shai-Hulud campaign that injected malicious hooks into .claude/settings.json and .vscode/tasks.json). Do the following:

Claude Code (.claude/):

1. Review .claude/settings.json and .claude/settings.local.json for any hooks entries that run shell commands. Flag anything that executes .js, .mjs, or .sh files — especially from within .claude/, .vscode/, or node_modules/.
2. Remove any hooks you cannot trace to a legitimate, user-created purpose.
3. Add a .gitignore rule to prevent from being committed (it should stay local).

Prompt 3: GitHub Actions hardening

Audit and harden the GitHub Actions configuration in this repository against CI/CD supply chain attacks. Do the following:

1. Remove or refactor any pull_request_target triggers — these run workflow code in the context of the base repo with access to secrets, even when triggered by a fork. Replace with pull_request + a separate approval-gated workflow if needed.

2. Pin all third-party actions to full commit SHAs (not tags or branches). For example, replace actions/checkout@v4 with actions/checkout@<full-sha>. Add a comment with the tag for readability.

3. Apply least-privilege permissions to every workflow. Add explicit permissions: blocks. Most workflows only need contents: read. Publish workflows need id-token: write — and nothing else.

4. Restrict cache scope: If using actions/cache, ensure cache keys are branch-scoped to prevent cross-branch poisoning. Add restore-keys carefully — don't restore caches from untrusted branches.

5. Add StepSecurity Harden-Runner as the first step in every job: with (or if you know your allowed endpoints).

License

MIT