UiPath — CraftedSignal Threat Feedhttps://feed.craftedsignal.io/vendors/uipath/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 12 May 2026 07:01:02 +0000Mini Shai-Hulud Campaign Compromises npm Packageshttps://feed.craftedsignal.io/briefs/2026-05-mini-shai-hulud-npm/Tue, 12 May 2026 07:01:02 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-05-mini-shai-hulud-npm/The Mini Shai-Hulud supply chain campaign, attributed to TeamPCP, has compromised several npm packages, including those within the @tanstack, @uipath, and @mistralai namespaces, leading to credential theft and potential further compromise.On May 11, 2026, TeamPCP launched a coordinated supply chain attack against the npm ecosystem, compromising packages across multiple namespaces simultaneously. Impacted packages include those in the @tanstack, @uipath, and @mistralai namespaces. The TanStack compromise exploited a chain of three vulnerabilities in GitHub Actions, allowing the attacker to poison the cache and extract OIDC tokens. The published packages contain two infection vectors: an optionalDependencies entry and an embedded ~2.3MB obfuscated file named router_init.js. The UiPath packages use a preinstall script (node setup.mjs) to download the Bun runtime and execute the payload. This campaign uses similar methods to previous TeamPCP operations.

Attack Chain

  1. Attacker creates a fork of a legitimate repository (e.g., TanStack/router) and renames it (e.g., zblgg/configuration).
  2. Attacker opens a pull request to the original repository, triggering a pull_request_target workflow.
  3. The workflow checks out and executes the attacker’s fork code.
  4. The attacker’s code poisons the GitHub Actions cache with a malicious pnpm store.
  5. Legitimate maintainer pull requests are merged, restoring the poisoned cache.
  6. Attacker-controlled binaries extract OIDC tokens from the GitHub Actions runner’s process memory (/proc/<pid>/mem).
  7. The attacker uses stolen tokens to publish malicious package versions to npm.
  8. The published packages execute a credential stealer and self-propagating worm that exfiltrates data via git-tanstack[.]com, Session messenger network, and GitHub API dead drops.

Impact

The compromised npm packages can lead to the theft of sensitive credentials, including CI/CD tokens (GitHub Actions OIDC, GitLab, CircleCI), cloud credentials (AWS IMDSv2, GCP, Azure), Kubernetes service accounts, HashiCorp Vault tokens, and package registry tokens. The self-propagating worm functionality allows the attacker to further compromise other npm packages the victim has write access to. On developer machines, the malware installs a persistent gh-token-monitor daemon that polls GitHub and can wipe the home directory if a token is revoked.

Recommendation

  • Search lockfiles and CI logs for affected package versions, specifically looking for router_init.js or setup.mjs at package roots (see affected packages list in this brief).
  • Search for the gh-token-monitor daemon on developer machines and remove it before revoking GitHub tokens to avoid the wiper (see Attack Chain and Overview).
  • Block the C2 domain git-tanstack.com and *.getsession.org at the DNS/proxy level (see IOCs).
]]>highthreatsupply-chainnpmmalware