Compromised Mistral AI and TanStack packages may have exposed GitHub, cloud and CI/CD credentials in ‘mini Shai Hulud’ malware infection — supply-chain campaign spreads across npm and AI developer ecosystems like wildfire

Microsoft Threat Intelligence confirmed that the PyPI package mistralai version 2.4.6 was compromised with malicious code that downloads and executes a secondary payload on Linux systems, raising concerns about a widespread supply-chain attack affecting developer ecosystems.

On May 12, 2026, Microsoft disclosed that the mistralai package, used in AI development, contained code that silently downloaded and executed a malicious payload from a remote server during import on Linux machines. The code was inserted into mistralai/client/__init__.py, and the payload, named transformers.pyz, was stored in the /tmp directory.

Simultaneously, security firm Aikido reported that several packages in the TanStack JavaScript ecosystem, including @tanstack/react-router, @tanstack/history, and @tanstack/router-core, had also been compromised in two attack waves beginning around 19:20 UTC. These packages are widely used, with tens of millions of downloads weekly.

Later, Aikido identified that multiple Mistral npm SDK packages, such as @mistralai/mistralai, @mistralai/mistralai-azure, and @mistralai/mistralai-gcp, were affected as part of what is believed to be the same campaign, dubbed “Mini Shai-Hulud.” Developers were advised to immediately rotate GitHub tokens, cloud API keys, and other credentials if affected packages were installed.

Why It Matters

The incidents underscore a rising threat to the software supply chain, where trusted packages are compromised to steal credentials, access developer infrastructure, and potentially infect downstream systems. Given the widespread use of these packages, the risk of large-scale breaches and data exfiltration is significant, especially as many development environments contain high-value credentials like cloud keys and GitHub tokens.

This escalation highlights how attackers are increasingly targeting the infrastructure behind software development rather than end-user applications directly, posing a threat to enterprise security and cloud environments.

Background

Supply-chain attacks have grown in frequency and sophistication, with notable incidents such as SolarWinds, event-stream npm, and the 3CX breach. The current wave appears to focus on AI tooling and cloud SDKs, reflecting the high value of these assets. Microsoft’s analysis indicates the malware used curl to retrieve secondary payloads, operating silently and designed to evade detection, primarily affecting Linux systems, which are dominant in cloud and AI workloads.

“The malicious code in mistralai version 2.4.6 silently downloads and executes a secondary payload on Linux systems, raising concerns about the integrity of supply chains.”

— Microsoft Threat Intelligence

“We have identified multiple affected packages across npm and PyPI, and advise developers to rotate all related credentials immediately.”

— Aikido Security

What Remains Unclear

It remains unclear whether the attacks are directly linked to the broader Mini Shai-Hulud campaign or if multiple threat actors are involved. The full extent of compromised packages and the potential access gained to developer credentials or infrastructure are still under investigation. Details about the attack’s origin, attribution, and long-term impact are yet to be confirmed.

What’s Next

Authorities and security teams are continuing to investigate the scope of the breach. Developers are advised to audit their environments, rotate credentials, and monitor for indicators of compromise such as specific files or unusual network activity. Further updates are expected as more affected packages are identified and analyzed.

Key Questions

What packages are affected by this compromise?

Confirmed affected packages include mistralai 2.4.6 on PyPI, and several in the TanStack JavaScript ecosystem, as well as related Mistral npm SDK packages. The full scope is still being determined.

What should developers do if they used these packages?

Developers should immediately rotate all related credentials, including GitHub tokens, cloud API keys, and CI/CD secrets. They should also monitor their systems for signs of compromise and consider isolating affected Linux hosts.

Is this attack linked to the Mini Shai-Hulud campaign?

Microsoft has not officially confirmed the connection, but the characteristics of the attacks—malicious code, staged payloads, credential theft—are similar to those attributed to Mini Shai-Hulud. Investigations are ongoing.

What are the potential consequences of this breach?

If successful, attackers could access sensitive developer credentials, compromise cloud environments, or infect downstream applications, potentially leading to data theft, service disruption, or further supply-chain attacks.