By Addison Thompson 
Five months after npm shut off the long-lived publishing tokens that had made a string of supply-chain worms possible, attackers came back through the mechanism that replaced them. Beginning around May 11, 2026, a wave of malicious package versions dubbed “Mini Shai-Hulud” hit 169 npm package names and two PyPI packages, reaching the dependency trees of TanStack, Mistral AI, UiPath and OpenSearch.
What made this wave different was not its size. It was that, according to Akamai’s write-up, it did not start with a stolen credential at all.
What happened in May
Security vendor Aikido, which tracked the incident as it unfolded, counted 169 affected npm package names across 373 malicious package-version entries. The heaviest concentrations were in the TanStack family of JavaScript routing and data libraries, the Squawk tooling packages, and UiPath’s npm namespace; the PyPI side was limited to two packages, including a Mistral AI client library.
The payload was a credential harvester. NHS England, which issued its own alert to health service suppliers on May 12, 2026, described malware that “attempts to harvest sensitive information from the affected environment, including GitHub and npm tokens, CI/CD secrets, cloud credentials” — and which could then spread laterally wherever those stolen credentials carried publishing rights.
The worm also carried a punitive component. Orca Security’s analysis described a persistent watcher that would destroy a developer’s home directory if the associated GitHub token were revoked — a design choice aimed squarely at making cleanup risky.
The registry had just hardened publishing
The timing is what gives the incident its weight. npm spent late 2025 dismantling the credential model that earlier Shai-Hulud waves had exploited. GitHub, which operates the registry, disabled creation of new classic tokens in early November 2025 and then, on December 9, 2025, revoked all remaining ones outright.
In their place npm introduced short-lived session authentication — two-hour tokens issued at login and expiring automatically — command-line management for granular tokens, and, for automated release pipelines, OIDC “trusted publishing,” in which the continuous integration system proves its identity to the registry for a single workflow run instead of holding a stored secret. GitHub framed the change as strengthening authentication “to protect the entire JavaScript ecosystem.”
The May attack targeted that new path. Aikido found the compromised releases had gone out through GitHub Actions OIDC tokens and trusted publishing workflows. Akamai put the shift bluntly: “Every previous wave began with a stolen credential. This one did not.”
Aikido’s conclusion is the sentence the industry has been repeating since: “Provenance can tell you where the package was built. It does not prove the build was safe.”
Maintainers had flagged the gap
The risk was not a surprise to everyone. Reporting by Socket at the time of the token revocation documented an OpenJS Foundation advisory cautioning maintainers about the new arrangement. Wes Todd, a senior engineer at Netflix and a Node.js ecosystem contributor, said “gaps in design and implementation with the new OIDC Trusted Publisher workflows leave maintainers open to novel gaps.” The foundation advised critical projects to harden existing workflows rather than rush to adopt OIDC publishing.
Node.js collaborator Jordan Harband was sharper: “OIDC and token-based publishing are default insecure, full stop.” The control he and others said was missing is enforced human friction at publish time — a second factor that a compromised build job cannot supply on its own.
Neither objection was that trusted publishing is worse than what it replaced. It is that removing the long-lived secret moves the target rather than eliminating it: whoever controls the build controls the release.
Government and enterprise response
The response has been fragmented, running through national health and sector CERTs rather than a single coordinating advisory. NHS England’s May 12 alert, rated medium severity, told suppliers to pin known-good package versions and delay new installations to prevent automatic updates, watch for unusual npm publish events, rotate cloud, GitHub, npm and API credentials, and treat any system with an affected package installed as compromised.
US agencies have addressed adjacent incidents in the same family — CISA published an advisory in April 2026 on a supply-chain compromise affecting the widely used Axios npm package — but the May wave was handled largely by registry operators and commercial threat researchers, with npm removing affected versions after notification.
It did not stop
The pattern repeated. On August 4, 2026, Sonatype reported a further Mini Shai-Hulud wave affecting 2,225 software component versions, including the widely depended-upon keyv and cacheable caching libraries and packages in the @servicetitan namespace. Sonatype’s research team described malware that “searches local files, environment variables, running processes, cloud metadata services, Kubernetes service accounts, and Vault locations” for credentials of almost every kind.
Three waves in eleven months, each larger than the last, is no longer an incident pattern. It is a standing condition of using public package registries.
What organizations are being advised to do
The advice converging across vendor and CERT guidance is unusually consistent, and mostly about slowing down:
- Pin dependency versions and use lockfiles, so a malicious release cannot arrive automatically.
- Introduce a deliberate delay before adopting new package versions, which is enough for most of these waves to be detected and pulled.
- Treat continuous integration systems as production infrastructure — the credentials they hold now open more doors than most developer laptops.
- Maintain an inventory of what your builds actually pull in, so that “are we affected?” is a query rather than an investigation.
- Assume credential rotation, not just package removal, is the remediation step after any exposure.
None of that prevents a compromised upstream release. It limits how far one travels, and how long it takes to find out.
Sources
- Mini Shai-Hulud is back: TanStack compromised — Aikido
- Mini Shai-Hulud: The Worm Returns and Goes Public — Akamai
- Supply Chain Attack Affecting Numerous npm and PyPI Packages (CC-4781) — NHS England Digital
- npm classic tokens revoked, session-based auth now available — GitHub Changelog
- npm Revokes Classic Tokens, as OpenJS Warns Maintainers — Socket
- Mini Shai-Hulud npm attack: more than 2,200 components impacted — Sonatype