Country visual unavailable
No information
Mini Shai-Hulud compromises TanStack packages and propagates downstream
On 11 May 2026 attackers compromised TanStack's Router/Start publishing workflow and released 84 malicious versions across 42 npm packages. The compromise propagated downstream: Mistral confirmed malicious SDK releases and an affected developer device, while OpenAI confirmed two employee devices were impacted, limited credential material was exfiltrated and code-deployment workflows were temporarily restricted.
83
Estimated severity
83 / 100
94
Source reliability
94 / 100
Approximate Date
11/05/2026
Targeted Company
TANSTACK
Targeted Company Supply Chain Impact
Distribution & Fulfillment
Procurement & Sourcing
Production & Manufacturing
Sales (Retail & Ecommerce)
Warehousing
Service Delivery
Unrecognized Impact
Supply Chain Relations
MISTRAL AI (Software vendor)OPENAI (Software vendor)
Geographic Impact
Country Targeted Company
Other Affected Countries
No other affected countries reported
Target country
No information
Affected countries
No information
Impacted regions
No information
Operational Impact
Duration
No information
Financial impact (USD M)
No information
Impact types
Supply chain data integrity impactDownstream customer disruption
Affected sectors
Technology & IT Services
Affected departments
Information Technology
Attack Profile
Attack types
Software supply chain compromiseMalwareData exfiltrationExploitation of misconfiguration
Attributed threat actors
TEAMPCP
Sources
Incident Sources
stepsecurity.iohttps://www.stepsecurity.io/blog/mini-shai-hulud-is-back-a-self-spreading-supply-chain-attack-hits-the-npm-ecosystemdocs.mistral.aihttps://docs.mistral.ai/resources/security-advisories/MAI-2026-002openai.comhttps://openai.com/index/our-response-to-the-tanstack-npm-supply-chain-attack/