Campaign · Open Source · 2026-05-11 to 2026-05-19 · 8 days

Shai-Hulud hits npm and PyPI

Shai-Hulud: Here We Go Again was a May 2026 TeamPCP campaign affecting roughly 169 to 170+ npm package names, plus 2 PyPI packages, with combined reported download volume above 200 million per week.

Draws together 29 incidents across 459 packages

A self-spreading npm worm researchers dubbed "Mini Shai-Hulud" tore through more than 170 JavaScript packages and at least two Python packages over eight days in May 2026, in what JFrog, Aikido, Socket, and StepSecurity described as a second major outing for a TeamPCP-linked operation that first surfaced under the Shai-Hulud name in late 2025.

Researchers said the campaign was aimed at package publishers themselves rather than at any single project. JFrog reported more than 170 npm packages and two PyPI packages, while Aikido counted 373 malicious package-version entries across 169 npm names as the list was refined over several days. The npm payload imported @tanstack/setup as a GitHub-sourced dependency, rewrote package metadata, bumped versions, and republished infected tarballs using stolen npm tokens. Inside GitHub Actions runners, researchers said it could also abuse OIDC trusted publishing to mint a fresh npm publish token under a legitimate workflow identity, a step earlier worms had not reached.

The malware daemonized after install so the package manager could return a successful exit while harvesting continued in the background. Its value was in recursion: any package install in a privileged developer or CI environment could leak tokens, enumerate more publishable packages, and seed the next wave.

High-value scopes, including TanStack, Mistral, UiPath, OpenSearch prereleases, and Guardrails, are recorded separately where the package evidence is precise. This campaign record holds the moving aggregate and the common mechanics.

Notes

Aikido reported 373 malicious package-version entries across 169 npm package names on May 12, 2026; JFrog separately reported 170+ npm packages plus 2 PyPI packages. The count shifted as researchers removed false positives and added newly discovered package versions.
Legacy artifact note: 170+ npm unique packages in JFrog Appendix A, excluding separately tracked @tanstack/* packages
Legacy artifact note: @uipath/* packages
Legacy artifact note: @squawk/* packages
Legacy artifact note: @tallyui/* packages
Legacy artifact note: @beproduct/nestjs-auth
Legacy artifact note: @draftlab/* and @draftauth/* packages
Legacy artifact note: @taskflow-corp/cli and @tolka/cli
Legacy artifact note: @ml-toolkit-ts/*, @mesadev/*, @dirigible-ai/sdk, and @supersurkhet/* packages
Legacy artifact note: @mistralai/mistralai@2.2.2, 2.2.3, 2.2.4
Legacy artifact note: @mistralai/mistralai-azure@1.7.1, 1.7.2, 1.7.3
Legacy artifact note: @mistralai/mistralai-gcp@1.7.1, 1.7.2, 1.7.3
Legacy artifact note: @opensearch-project/opensearch prereleases tracked separately
Legacy artifact note: guardrails-ai@0.10.1

Incidents in this campaign

2026-05-11 BeProduct npm package carried Shai-Hulud
2026-05-11 Dirigible AI npm package carried Shai-Hulud
2026-05-11 DraftAuth npm packages carried Shai-Hulud
2026-05-11 DraftLab npm packages carried Shai-Hulud
2026-05-11 ML Toolkit TS npm packages carried Shai-Hulud
2026-05-11 MesaDev npm packages carried Shai-Hulud
2026-05-11 Squawk npm packages carried Shai-Hulud
2026-05-11 SuperSurkhet npm packages carried Shai-Hulud
2026-05-11 Tally UI npm packages carried Shai-Hulud
2026-05-11 Taskflow Corp npm package carried Shai-Hulud
2026-05-11 Tolka npm package carried Shai-Hulud
2026-05-11 UiPath npm packages carried Shai-Hulud
2026-05-11 agentwork-cli npm package carried Shai-Hulud
2026-05-11 cmux-agent-mcp npm package carried Shai-Hulud
2026-05-11 cross-stitch npm package carried Shai-Hulud
2026-05-11 git-branch-selector npm package carried Shai-Hulud
2026-05-11 git-git-git npm package carried Shai-Hulud
2026-05-11 guardrails-ai PyPI package carried Shai-Hulud
2026-05-11 nextmove-mcp npm package carried Shai-Hulud
2026-05-11 OpenSearch prereleases carried Shai-Hulud
2026-05-11 safe-action npm package carried Shai-Hulud
2026-05-11 TanStack packages hit by Mini Shai-Hulud
2026-05-11 ts-dna npm package carried Shai-Hulud
2026-05-11 wot-api npm package carried Shai-Hulud
2026-05-12 Mistral SDK packages imported Shai-Hulud loader
2026-05-18 actions-cool GitHub Actions tags rewritten by TeamPCP
2026-05-18 Nx Console VS Code extension shipped credential stealer
2026-05-19 AntV ecosystem npm packages hit by TeamPCP
2026-05-19 Microsoft durabletask PyPI hit by Mini Shai-Hulud

Appendix · Affected packages

@beproduct 2026-05-11 to 2026-05-12

0.1.180.1.190.1.17 +5 more

@dirigible-ai 2026-05-11 to 2026-05-12

0.6.30.6.2

@draftauth 2026-05-11 to 2026-05-12

0.2.20.2.1

@draftauth 2026-05-11 to 2026-05-12

0.13.10.13.2

@draftlab 2026-05-11 to 2026-05-12

0.24.20.24.1

@draftlab 2026-05-11 to 2026-05-12

0.5.10.5.2

@draftlab 2026-05-11 to 2026-05-12

0.16.20.16.1

@ml-toolkit-ts 2026-05-11 to 2026-05-12

1.0.21.0.3

@ml-toolkit-ts 2026-05-11 to 2026-05-12

1.0.31.0.4

ml-toolkit-ts 2026-05-11 to 2026-05-12

1.0.51.0.4

@mesadev 2026-05-11 to 2026-05-12

0.28.3

@mesadev 2026-05-11 to 2026-05-12

0.4.22

447 more packages

@mesadev 2026-05-11 to 2026-05-12

0.28.3

@squawk 2026-05-11 to 2026-05-12

0.7.80.7.70.7.6 +2 more

@squawk 2026-05-11 to 2026-05-12

0.6.60.6.50.6.4 +2 more

@squawk 2026-05-11 to 2026-05-12

0.8.50.8.30.8.4 +2 more

@squawk 2026-05-11 to 2026-05-12

0.5.70.5.50.5.6 +2 more

@squawk 2026-05-11 to 2026-05-12

0.5.80.5.70.5.6 +2 more

@squawk 2026-05-11 to 2026-05-12

0.4.60.4.40.4.5 +2 more

@squawk 2026-05-11 to 2026-05-12

0.6.80.6.70.6.6 +2 more

@squawk 2026-05-11 to 2026-05-12

0.3.60.3.50.3.4 +2 more

@squawk 2026-05-11 to 2026-05-12

0.5.80.5.70.5.6 +2 more

@squawk 2026-05-11 to 2026-05-12

0.5.60.5.50.5.4 +2 more

@squawk 2026-05-11 to 2026-05-12

0.4.80.4.70.4.6 +2 more

@squawk 2026-05-11 to 2026-05-12

0.5.60.5.50.5.4 +2 more

@squawk 2026-05-11 to 2026-05-12

0.8.80.8.60.8.7 +2 more

@squawk 2026-05-11 to 2026-05-12

0.9.50.9.40.9.3 +2 more

@squawk 2026-05-11 to 2026-05-12

0.6.80.6.70.6.6 +2 more

@squawk 2026-05-11 to 2026-05-12

0.4.60.4.50.4.4 +2 more

@squawk 2026-05-11 to 2026-05-12

0.3.100.3.90.3.8 +2 more

@squawk 2026-05-11 to 2026-05-12

0.7.70.7.50.7.6 +2 more

@squawk 2026-05-11 to 2026-05-12

0.5.60.5.40.5.5 +2 more

@squawk 2026-05-11 to 2026-05-12

0.8.50.8.30.8.4 +2 more

@squawk 2026-05-11 to 2026-05-12

0.4.70.4.50.4.6 +2 more

@squawk 2026-05-11 to 2026-05-12

0.5.100.5.80.5.9 +2 more

@supersurkhet 2026-05-11 to 2026-05-12

0.0.70.0.60.0.5 +3 more

@supersurkhet 2026-05-11 to 2026-05-12

0.0.70.0.60.0.5 +3 more

@tallyui 2026-05-11 to 2026-05-12

1.0.31.0.21.0.1

@tallyui 2026-05-11 to 2026-05-12

1.0.31.0.21.0.1

@tallyui 2026-05-11 to 2026-05-12

1.0.31.0.21.0.1

@tallyui 2026-05-11 to 2026-05-12

1.0.31.0.21.0.1

@tallyui 2026-05-11 to 2026-05-12

1.0.31.0.21.0.1

@tallyui 2026-05-11 to 2026-05-12

0.2.30.2.20.2.1

@tallyui 2026-05-11 to 2026-05-12

1.0.31.0.21.0.1

@tallyui 2026-05-11 to 2026-05-12

0.1.30.1.20.1.1

@tallyui 2026-05-11 to 2026-05-12

0.2.30.2.20.2.1

@tallyui 2026-05-11 to 2026-05-12

0.2.30.2.20.2.1

@taskflow-corp 2026-05-11 to 2026-05-12

0.1.290.1.280.1.27 +3 more

@tolka 2026-05-11 to 2026-05-12

1.0.51.0.61.0.4 +2 more