“Shai-Hulud, Here We Go Again”: 170+ Packages Hit Across npm & PyPi

The Infamous Credential Stealing Malware Once Again Hits npm & PyPi, Affecting Many Including Mistral AI, OpenSearch Project, TanStack.

Breaking News: Shai-Hulud malware spreads again in npm and PyPi, stealing credentials and self-propagating. Currently with over 170+ packages affected, over 518M monthly downloads in total.

Overview

Shai-Hulud is a self spreading malware, which we extensively researched and wrote about due to its widespread impact. Recent attacks and infections included – PyTorch Lightning & Intercom-Client, SAP npm Packages, and Bitwarden CLI.

This latest variant affecting Mistral AI, OpenSearch Project, TanStack and many others is even more dangerous due to the amount of successful infections around npm. 

This version also includes a token monitoring and machine wipe logic, which triggers when the developer tries to revoke the tokens captured or created by the malware.

Who is affected

Anyone who installed the latest npm packages in the last 24h from the following npm namespaces

• @uipath
• @squawk
• @beproduct
• @dirigible-ai
• @draftauth
• @mesadev
• @mistralai
• @ml-toolkit-ts
• @opensearch-project
• @supersurkhet
• @tallyui
• @tanstack

Or any of the following latest npm packages in the last 24h

• agentwork-cli
• cmux-agent-mcp
• cross-stitch
• git-branch-selector
• git-git-git
• ml-toolkit-ts
• nextmove-mcp
• safe-action
• ts-dna
• wot-api

Or any of the following PyPi packages in the last 24h

• mistralai@2.4.6
• guardrails-ai@0.10.1

Impact

• Total affected packages – 170+
• Total accumulated weekly downloads – 177,259,751
• Total accumulated monthly downloads – 518,765,599
• Total GitHub repositories with stolen credentials – 379
  • *Containing the “Shai-Hulud: Here We Go Again” string

Recommended Actions

Immediate Actions:

1. Rotate your keys and add 2FA to your accounts
2. Check for public GitHub repositories containing “Shai-Hulud: Here We Go Again” related strings
3. Downgrade the affected packages to a safe version

Treat the machine and any connected token, environment variable and API key as compromised.

Lessons for Security Leaders From the AI Supply Chain Crisis

Join us as we uncover 30+ disclosures and 10+ CVEs and explore what this new reality means for security leaders

Watch the Webinar

Infection Analysis

This new variant is ironically called – “Shai-Hulud: Here We Go Again”, after infecting users, it uploads an encrypted version of the stolen credentials to the victim’s GitHub account under a new repository.

We found 359 repositories with stolen credentials of the new Shai-Hulud variant, and the numbers keep growing as time goes by.

Example of encrypted stolen credentials inside the new repository:

Technical Analysis

The Python infection adds malicious code inside the __init__.py file, which executes when the code is imported – after import, it downloads the payload and executes it.

The Python packages affected – guardrails-ai and mistralai – had a malicious Python code downloaded from the following URLs in order to deliver the credential stealing malware. 

https://git-tanstack[.]com/transformers.pyz
https://83[.]142[.]209[.]194/transformers.pyz


After the malware stopped its infections, visiting the above URLs shows a message from TeamPCP


The npm infection is similar to what we’ve seen in the recent Shai-Hulud attacks


package.json – Preinstall hooks point to Bun installation script
setup.mjs – Bun installation script installs Bun and executes an obfuscated JavaScript payload
router_init.js – The JavaScript code extracts credentials, keys, exfiltrates the data to a remote C2 server and to GitHub, and tries to self-spread through npm

Example of package.json with the preinstall script pointing to Bun installation


Example from setup.mjs installing Bun


Example of the obfuscated router_init.js with the malicious code:


The obfuscated code has a multi-layered encryption to ensure domain names and other strings remain obfuscated until the code executes, this makes analysis far more difficult, and gives threat actors the option to have their code executed inside a sandbox in order for analysis to work, which might expose the machine to docker escape and VM escape exploits.



After decoding we see the same malicious actions we’ve already uncovered last month, including credential stealing, self propagating techniques, Russian language check, GitHub upload, and more.

The code now includes the “Shai-Hulud: Here We Go Again” string for the newly created repositories with stolen credentials.


Russian language check


A threat to developers not to revoke the created tokens – “IfYouRevokeThisTokenItWillWipeTheComputerOfTheOwner”, adding a persistent backdoor to the local machine, exfiltrating data from the GitHub repository and more



The malware continues to install a token monitor script – which checks if the token is working, if it stops working – the malware executes “rm -rf ~/” on the machine.

The malware sends the stolen credentials to https://git-tanstack[.]com, which is the same URL found in the Python version of the malware containing the malicious payload.

Conclusions

TeamPCP is probably working on a new Guinness category – “most supply chain attacks conducted in one year”.

Last time we said it was accelerating, now we see the impact, over 500M monthly downloads accumulated packages are now affected, while security teams are triaging and updating package versions, TeamPCP are working on the next attack.

They also become more aggressive with their actions, turning it to a wiper malware as well – which we see in the string saying “IfYouRevokeThisTokenItWillWipeTheComputerOfTheOwner” – and the actual script to actually wipe the machine if the token is revoked.

Identifying and blocking suspicious patterns such as npm’s preinstall hooks should be a default behavior, and should be only run after users gave explicit permission – if TeamPCP managed to slip through defenses for so many times in a row, our detection capabilities both on the client side and on the npm & PyPi side should be implemented or improved before the next wave hits.

We strongly recommend that security engineers and developers take immediate precautions: Implement time-based install logic to only pull packages older than 24 hours, enforce 2FA across npm, GitHub, and cloud accounts, and treat key rotation as a routine practice rather than an incident response measure.

Affected Packages