Mistral AI, TanStack Packages Hijacked to Steal GitHub Credentials
A compromised version of the official mistralai Python package automatically executed credential-stealing malware the moment developers imported it, while separate hijackings of popular TanStack JavaScript packages captured GitHub tokens, cloud keys, and CI/CD secrets, security firms disclosed on May 12, 2026. The attacks, part of the Mini Shai-Hulud supply-chain campaign, also hit Mistral’s npm SDKs and carried a destructive rm -rf capability under certain geographic conditions.
Why It Matters
Software supply chain attacks have become the fastest route into thousands of organizations. A 2025 Sonatype report found supply chain attacks surged 742% over three years, and the European Union Agency for Cybersecurity (ENISA) now ranks supply chain compromise among the top cybersecurity threats. Modern developer workstations and CI/CD runners hold GitHub personal access tokens, cloud deployment keys, npm publishing tokens, and SSH credentials, making a single poisoned pip install or npm install a ticket to entire cloud estates.
The Mini Shai-Hulud campaign illustrates a shift: attackers no longer need to phish end users when they can slip into the trusted packages that build AI applications. By camouflaging a second-stage payload as Hugging Face’s Transformers (transformers.pyz), the malware specifically targets machine learning environments where such filenames are normal, increasing the chance it blends in and survives long enough to exfiltrate credentials.
What’s New and How It Works
On PyPI, version 2.4.6 of the mistralai package was altered. Malicious code inserted into mistralai/client/__init__.py silently called curl to download a file from IP address 83.142.209.194, saving it as /tmp/transformers.pyz, and executed it as a detached background process whenever the package was imported on a Linux host. The payload suppressed errors, limited itself to Linux (the dominant OS for servers, cloud, and AI workloads), and refused to run on Russian-language systems, a behavior seen in some cybercriminal families but not a definitive attribution clue.
Once active, the second-stage payload functioned primarily as a credential stealer. It also contained a destructive branch that could execute rm -rf / under certain geographic conditions, effectively wiping the infected file system. Separately, security firm Aikido reported two attack waves on npm beginning around 19:20 UTC. Compromised packages included three widely used TanStack components (@tanstack/react-router, @tanstack/history, and @tanstack/router-core) collectively downloaded tens of millions of times per week, plus three Mistral AI npm SDKs (@mistralai/mistralai, @mistralai/mistralai-azure, and @mistralai/mistralai-gcp). Although Microsoft has not formally attributed the PyPI incident to Mini Shai-Hulud, the identical tactics, staged payload downloads, and credential-theft focus have led multiple researchers to treat them as one coordinated campaign.
The Numbers
- PyPI package compromised:
mistralaiversion 2.4.6, with injected code inmistralai/client/__init__.py. - Second-stage payload retrieved from IP 83.142.209.194 and saved as
/tmp/transformers.pyz, disguised as Hugging Face’s Transformers library. - Malware executes automatically on import, runs as a detached background process, and suppresses errors.
- Geographic logic: refuses to run on Russian-language systems; destructive
rm -rf /branch activates only under certain geographic conditions. - Three TanStack npm packages hijacked:
@tanstack/react-router,@tanstack/history,@tanstack/router-core(tens of millions of weekly downloads). - Three Mistral AI npm SDK packages compromised:
@mistralai/mistralai,@mistralai/mistralai-azure,@mistralai/mistralai-gcp. - Indicators of compromise include
/tmp/transformers.pyz,pgmonitor.py, andpgsql-monitor.service(Microsoft Threat Intelligence). - Multiple credential classes targeted: GitHub PATs, npm publishing tokens, cloud API keys, SSH credentials, and CI/CD secrets.
Attackers injected code in
mistralai/client/__init__.pythat executes on import, downloadshxxps://83[.]142[.]209[.]194/transformers.pyzto/tmp/transformers.pyz, and launches a second-stage payload on Linux.
A single
pip installcould hand attackers the keys to your entire cloud.
What Comes Next
Investigations continue, and additional compromised packages are likely to emerge as maintainers audit publishing histories and compromised accounts. The immediate priority is rotation of any credentials that may have been exposed, including GitHub tokens, npm publishing tokens, cloud API keys, and CI/CD secrets. Organizations should isolate affected Linux hosts, block outbound connections to 83.142.209.194, and scan for the identified indicators.
Longer term, the incident will accelerate adoption of supply-chain defenses: mandatory two-factor authentication on package registries, signed commits, provenance attestations, and software bills of materials (SBOMs). The Cybersecurity and Infrastructure Security Agency (CISA) has already pushed SBOMs as a baseline requirement for federal vendors, and attacks like this one amplify those conversations inside procurement and engineering leadership teams.
What This Means for You
If your team builds or deploys AI applications, treat any environment that pulled the compromised mistralai version or the affected TanStack and Mistral npm packages as potentially compromised. Rotate every secret stored on those hosts, from GitHub tokens to cloud deployment keys, and audit recent CI/CD runs for unexpected commits or artifacts.
Moving forward, pin dependencies to known-good versions with lockfile hash verification, enable 2FA on all package publishing accounts, and switch to short-lived, workload-identity-based credentials wherever your platform supports them. Supply chain integrity is as critical as model performance. For more on how developer platforms are evolving to meet security demands, see our piece on Cursor’s Origin, a Git forge built for the agentic era, and for context on the high-stakes environment these tools operate in, read about the SpaceX acquisition of Cursor for $60 billion.
The Bigger Picture
The Mini Shai-Hulud campaign is a clear signal that open-source registries are a primary theater for cyber conflict, and AI developer ecosystems are squarely in the crosshairs. Trust in a package name is not the same as trust in the code it runs, and organizations that treat every dependency as untrusted until verified will be the ones that stay ahead when the next trusted library is hijacked.
FAQ
Which specific packages were compromised in the Mini Shai-Hulud attack?
The PyPI package mistralai version 2.4.6 was tampered with, and on npm the packages @tanstack/react-router, @tanstack/history, @tanstack/router-core, @mistralai/mistralai, @mistralai/mistralai-azure, and @mistralai/mistralai-gcp were hijacked as part of the same campaign disclosed on May 12, 2026.
What credentials does the malware steal?
The second-stage payload targets GitHub personal access tokens, npm publishing tokens, cloud API keys (AWS, GCP, Azure), SSH credentials, and CI/CD pipeline secrets, any of which could let attackers push further malicious updates or pivot into production infrastructure.
What should teams do immediately if they pulled an affected package?
Rotate every credential on the affected host, isolate the machine, block outbound connections to IP 83.142.209.194, scan for /tmp/transformers.pyz, pgmonitor.py, and pgsql-monitor.service, and audit recent commits and deployment history for unauthorized changes.