Mini Shai-Hulud Is Back: npm Worm Hits over 160 Packages, including Mistral and Tanstack

A highly aggressive wave of the "Mini Shai-Hulud" npm worm has hit the open-source community, successfully compromising over 160 diverse packages, including highly popular libraries associated with Mistral AI, TanStack, UiPath, and Squawk. The worm operates via a chain reaction: once a developer unknowingly downloads an infected version of an affected package, the malware harvests local developer environment configurations and continuous integration secrets. The worm then hooks into the developer's trusted publishing workflows and uses their saved credentials to inject the identical malicious payload into entirely different, unrelated packages that the developer maintains. This horizontal movement allows the worm to leap across distinct software ecosystems, threatening the integrity of prominent artificial intelligence tools and frontend web frameworks globally.To halt the spread of this worm, software development teams must immediately freeze dependency updates and execute a complete audit of all installed modules against known-secure baselines. It is imperative to revoke all active npm automation tokens and publishing credentials across the enterprise to prevent automated, compromised code pushes. Implementing network egress filtering on all build servers will block the worm from communicating with its external command servers.If you need expert assistance in identifying compromised packages, securing your CI/CD pipelines, or conducting an emergency supply chain audit, contact Cyberlinx today to protect your development environment.