MesaDev npm packages carried Shai-Hulud

MesaDev entered the May 2026 Shai-Hulud wave through three related npm packages: @mesadev/rest, @mesadev/saguaro, and @mesadev/sdk. JFrog listed one affected release for each package, putting the compromise across an API, SDK, and service-integration surface at the same time.

That pattern fits TeamPCP's goal. Packages used for service access and SDK integration tend to be installed in projects and CI jobs with tokens, cloud configuration, GitHub credentials, and package-publishing access nearby. Shai-Hulud used install-time execution to collect that material and look for the next package it could republish.

This page keeps the MesaDev namespace separate from the campaign aggregate. The broader [[shai-hulud-here-we-go-again]] record carries the shared loader and propagation behavior; this record preserves the exact package names, releases, registry paths, and May 11-12 exposure window.

For defenders, the package list is the starting point. A hit in a lockfile, package cache, build log, or local npm cache should be handled as a potential credential-exposure event, even if the application using MesaDev never shipped.

Motive

Credential Theft

Attribution

Group

Cause

Compromised Account Credentials

Transitive

Yes

Actor

TeamPCP

• Minimal campaign-linked record created to keep Shai-Hulud package evidence scoped by vendor, organization, maintainer account, or package distribution surface.

• Shai-Hulud: Here We Go Again - Worm by TeamPCP Hits NPM and PyPIresearch.jfrog.com