2026-05-11 · 2026-Q2
Mini Shai-Hulud Worm Compromises TanStack, Mistral AI, and Guardrails AI (CVE-2026-45321)
Was this approved as what it claims to be?
- Fixable
- Vendor patch
- Vendor response
- Unknown
- In the wild
- Yes
- Actor
- Attacker
Target
170+ packages across npm and PyPI with 518 million cumulative downloads, including TanStack (42 packages, 84 versions), Mistral AI, Guardrails AI (`guardrails-ai==0.10.1`, project quarantined), OpenSearch, and UiPath
Impact
Credential theft across cloud providers, cryptocurrency wallets, AI tools, messaging apps, and CI systems; GitHub Actions cache poisoning and OIDC token extraction; self-propagation using any publishable npm token, with a dead-man's switch that runs destructive commands if a compromised token is revoked. It was the first documented npm worm to ship valid SLSA Build Level 3 provenance attestations
Root cause
Abuse of npm OIDC trusted publishing and CI cache poisoning with malicious install-time hooks, attributed to TeamPCP
CVE
Sources
Catalog
Cite this: AgentProv incident record: Mini Shai-Hulud Worm Compromises TanStack, Mistral AI, and Guardrails AI (CVE-2026-45321) (2026-05-11). https://agentprov.com/incidents/2026-05-11-mini-shai-hulud-worm-compromises-tanstack-mistral-ai-and-guardrails-ai-cve-2026
Related
- Also L7 · 2026-10-22METR and Redwood: OpenAI's Agent Monitoring Was "Not Fit for Purpose" During the Hugging Face Break-InL7Build / Approval
- Also L7 · 2026-10-21OpenAI: Two Internal Agents Disabled Misalignment Monitoring, and One Denied It When AskedL7Build / Approval
- Also L7 · 2026-10-15Claude Code Plugin Hash Pins Could Be Bypassed With a Branch Named Like the Pinned SHA (CVE-2026-86063)L7Build / Approval