Compromised Mistral AI and TanStack packages may have exposed GitHub, cloud and CI/CD credentials in ‘mini Shai Hulud’ malware infection — supply-chain campaign spreads across npm and AI developer ecosystems like wildfire

Microsoft Threat Intelligence confirmed that attackers compromised the mistralai PyPI package, injecting malicious code that downloads and executes a secondary payload on Linux systems, raising concerns over software supply-chain security.

On May 12, 2026, Microsoft disclosed that the mistralai PyPI package version 2.4.6 was compromised through malicious code inserted into its __init__.py file. The code silently downloads a payload from a remote IP address and executes it on Linux systems during import, potentially allowing attackers to execute malware remotely.

Simultaneously, security firm Aikido reported that several TanStack JavaScript packages, including @tanstack/react-router and @tanstack/history, had been compromised in two attack waves since around 19:20 UTC. These packages are widely used, with tens of millions of downloads weekly.

Further, Aikido identified that Mistral npm SDK packages, such as @mistralai/mistralai, @mistralai/mistralai-azure, and @mistralai/mistralai-gcp, were also affected as part of the same campaign, dubbed “Mini Shai-Hulud.” The attack involved staged payload downloads, credential theft, and automatic execution, aiming to infiltrate developer infrastructure.

Why It Matters

This incident underscores the increasing danger of supply-chain attacks targeting developer ecosystems, especially those involving AI, cloud SDKs, and frontend frameworks. Compromised packages can propagate malicious code into thousands of applications, potentially leading to widespread credential theft, data breaches, and infrastructure compromise.

Given the high-value credentials stored in developer environments—such as GitHub tokens, cloud keys, and CI/CD secrets—the impact could extend beyond individual packages, affecting entire organizations and cloud services.

Background

Recent years have seen major supply-chain breaches like SolarWinds and the event-stream npm attack, highlighting the vulnerability of trusted dependencies. The current wave appears to focus on AI and cloud SDKs, with attackers aiming to steal credentials and gain persistent access to developer and cloud environments.

While Microsoft has not explicitly linked the PyPI compromise to the Mini Shai-Hulud campaign, the similarities in attack patterns—malicious code insertion, staged payloads, and credential theft—suggest a possible connection. Investigations are ongoing.

“The injected code silently used curl to retrieve a secondary payload before launching it as a detached background process, primarily affecting Linux systems.”

— Microsoft Threat Intelligence

“The compromised packages include widely used JavaScript libraries and Mistral SDKs, with the goal of credential theft and ecosystem infiltration.”

— Aikido security firm

What Remains Unclear

It remains unclear whether the PyPI mistralai compromise is directly linked to the Mini Shai-Hulud campaign targeting npm packages. The full extent of affected packages and the specific motives behind the attack are still under investigation. Additional compromised packages may be identified as security teams continue auditing.

What’s Next

Organizations are advised to isolate affected Linux hosts, block outbound connections to the malicious IP, hunt for indicators such as /tmp/transformers.pyz, and rotate all potentially exposed credentials. Security agencies and maintainers are expected to release further updates as investigations progress and additional compromised packages are identified.

Key Questions

What is the Mini Shai-Hulud campaign?

The Mini Shai-Hulud campaign is a recent series of supply-chain attacks targeting developer packages across ecosystems like npm and PyPI, involving malicious code insertion for credential theft and infrastructure compromise.

Which packages are affected?

Confirmed affected packages include mistralai v2.4.6 on PyPI, and several TanStack JavaScript packages such as @tanstack/react-router, as well as Mistral SDK packages like @mistralai/mistralai. Additional packages may be identified as investigations continue.

What should developers do now?

Developers should immediately rotate credentials, monitor for suspicious activity, and audit their environments for indicators like /tmp/transformers.pyz. They should also consider isolating affected systems and blocking malicious IP addresses.

Could this lead to broader security breaches?

Yes, if attackers successfully steal credentials or compromise build and deployment pipelines, they could extend their access to cloud environments, CI/CD systems, and other critical infrastructure, amplifying the impact.