--- title: "TanStack, Mistral AI and Guardrails AI npm/PyPI Packages Hit by Mini Shai-Hulud - CVE-2026-45321" description: "CVE-2026-45321: the Mini Shai-Hulud wave hit 42 @tanstack packages across 84 versions plus 170+ npm/PyPI packages to steal CI/CD and cloud secrets." url: "https://anomity.ai/blog/tanstack-mini-shai-hulud-cve-2026-45321/" source: html --- On this page - What happened - Why this is an agentic-endpoint risk - How Anomity surfaces and governs it - What to check across your fleet - Frequently asked questions [← Back to blog](https://anomity.ai/blog/) - Home - Blog - TanStack, Mistral AI and Guardrails AI npm/PyPI Packages Hit by Mini Shai-Hulud - CVE-2026-45321 ![Anomity robot illustrating TanStack, Mistral AI and Guardrails AI npm/PyPI Packages Hit by Mini Shai-Hulud - CVE-2026-45321] Advisory Critical # TanStack, Mistral AI and Guardrails AI npm/PyPI Packages Hit by Mini Shai-Hulud - CVE-2026-45321 Anomity Research Anomity Threat Research · May 11, 2026 · 4 min read Share: Copied AI Supply-Chain Attacks · Critical · CVE-2026-45321 (GHSA-g7cv-rxg3-hmpx) · May 11, 2026 Affected 42 @tanstack packages across 84 versions (e.g. @tanstack/react-router 1.169.5/1.169.8); plus Mistral AI, Guardrails AI, UiPath, OpenSearch packages - 170+ packages, 518M+ cumulative downloads across npm and PyPI On **May 11, 2026**, researchers disclosed the **Mini Shai-Hulud** wave, a self-replicating supply-chain compromise attributed to the actor **TeamPCP** and tracked as **CVE-2026-45321** (advisory **GHSA-g7cv-rxg3-hmpx**), rated **Critical** at **CVSS 9.6**. This advisory covers what was compromised, why it lands on the agentic-endpoint layer, and how to scope and govern it across your fleet. ## What happened The wave compromised **42 packages in the @tanstack namespace across 84 malicious versions** - for example `@tanstack/react-router` versions **1.169.5** and **1.169.8**. The same campaign reached packages published by **Mistral AI**, **Guardrails AI**, **UiPath**, and **OpenSearch**, totaling more than **170 packages** across **npm** and **PyPI** with over **518 million cumulative downloads**. The full 42-package `@tanstack` list is enumerated in **GHSA-g7cv-rxg3-hmpx**. Each compromised tarball injects an `optionalDependencies` entry - such as `@tanstack/setup` - that points to an attacker-controlled **GitHub orphan commit**. That dependency's `package.json` declares a `prepare` lifecycle hook, `bun run tanstack_runner.js && exit 1`, which runs the payload during install and then deliberately exits non-zero. The intentional failure makes the malicious step look like a broken optional dependency, evading casual review of install logs. Because the hook invokes the **Bun runtime**, endpoints with Bun pre-installed are the most exposed. The payload is a credential stealer that targets **GitHub Actions OIDC**, **GitLab** and **CircleCI** CI/CD tokens, **AWS IMDSv2**, **GCP** and **Azure** cloud credentials, **Kubernetes** service accounts, **HashiCorp Vault**, and **package-registry tokens**. Affected versions should be removed and every reachable CI/CD and cloud secret rotated. ## Why this is an agentic-endpoint risk This is a worm-class attack in the same family as the earlier npm credential-stealer wave covered in [Shai-Hulud 2: the npm worm credential stealer](https://anomity.ai/blog/shai-hulud-2-npm-worm-credential-stealer/). What makes Mini Shai-Hulud an agentic-endpoint problem is where it executes: on the same developer workstations, build agents, and CI runners where AI coding agents and their tooling already live. Many of those machines have **Bun** installed precisely because AI agent frameworks and MCP servers use it. The eight AI artifact types Anomity inventories - AI agents, MCP servers, extensions, skills, plugins, secrets, hooks, and CLIs - share the endpoint with this install-time payload. The `prepare` hook runs arbitrary code with the developer's full identity, and the secrets it harvests are the same tokens an AI agent would use to reach cloud APIs, registries, and Kubernetes. A rogue MCP server or CLI dropped during install becomes a persistent foothold that ordinary package scanning does not watch. Inventorying that layer is the visibility gap this advisory addresses - see [fleet visibility](https://anomity.ai/#features) and how this fits alongside your existing tools in [the comparison](https://anomity.ai/#compare). ## How Anomity surfaces and governs it Anomity works in three steps against this campaign. First, **inventory**: it enumerates the AI artifacts on every managed endpoint, including the **Bun CLI** that the payload depends on and any rogue MCP server or CLI artifact dropped during install. If Bun is present on a machine that does not need it, that alone is a signal worth reviewing in [fleet visibility](https://anomity.ai/#features). Second, **allow / deny / log at the hook**: on agents that expose a hook - for example Claude Code **PreToolUse** - Anomity evaluates each tool call before it runs and returns allow, deny, or log. An install-time command that invokes the Bun runtime through a `prepare` lifecycle hook can be denied before the credential stealer executes, stopping exfiltration at the moment of execution rather than after the tokens are gone. See [runtime governance](https://anomity.ai/#runtime-governance). Third, a queryable **90-day audit trail**: every decision and artifact change is recorded, so after disclosure you can ask which endpoints ran the install, which identities were reachable, and which calls were denied. Anomity collects metadata only, with on-endpoint secret redaction, is SOC 2 Type II, and routes decisions to SIEM, Slack, email, and Jira. Review the [audit trail](https://anomity.ai/#outcomes) to scope the blast radius and feed rotation work into your existing GRC process; the [documentation](https://anomity.ai/docs/) covers how decisions are routed and retained. Anomity complements your network controls, EDR, DLP, and GRC rather than replacing them. ## What to check across your fleet - Identify every endpoint with the Bun runtime installed - these are the highest-risk machines for this payload. - Search lockfiles and node_modules for the 42 affected @tanstack versions enumerated in GHSA-g7cv-rxg3-hmpx , including @tanstack/react-router 1.169.5 and 1.169.8 . - Check npm and PyPI installs for the affected Mistral AI, Guardrails AI, UiPath, and OpenSearch packages across the 170+ named in the disclosure. - Flag any optionalDependencies entry such as @tanstack/setup resolving to a GitHub orphan commit , and any prepare hook that shells out to bun run . - On any machine that ran an install, rotate GitHub Actions OIDC , GitLab , and CircleCI tokens; AWS IMDSv2 , GCP , and Azure credentials; Kubernetes service accounts; HashiCorp Vault secrets; and package-registry publish tokens. - Inventory MCP servers and CLIs on developer and CI endpoints for artifacts that appeared during the disclosure window. - Confirm hook-based deny is enabled on agents that expose a hook so install-time tool calls are governed going forward. Mini Shai-Hulud is one entry in a widening pattern of lifecycle-hook supply-chain attacks. For the broader playbook - how these waves replicate, what to monitor, and how to govern the AI artifact layer they exploit - see the parent guide, [AI Supply-Chain Attacks: A Defender's Guide](https://anomity.ai/blog/ai-supply-chain-attacks-defenders-guide/). To inventory the Bun runtime and rogue MCP/CLI artifacts across your endpoints and deny install-time tool calls before exfiltration, [book a demo](https://anomity.ai/#early-access). Share: Copied ## Frequently asked questions Which packages and versions are affected by CVE-2026-45321? The advisory GHSA-g7cv-rxg3-hmpx enumerates 42 @tanstack packages spanning 84 malicious versions, including @tanstack/react-router 1.169.5 and 1.169.8. The same Mini Shai-Hulud wave, attributed to the actor TeamPCP, also reached packages from Mistral AI, Guardrails AI, UiPath, and OpenSearch - more than 170 packages across npm and PyPI with over 518 million cumulative downloads. Remove any affected version, reinstall from a known-good release, and treat any machine that ran an install as compromised. Because the payload activates at install time, simply pinning a clean version after the fact does not undo credential theft that already occurred. How does the install-time payload work? A compromised tarball adds an optionalDependencies entry such as @tanstack/setup pointing to an attacker-controlled GitHub orphan commit. That dependency's package.json declares a prepare lifecycle hook (bun run tanstack_runner.js && exit 1) that runs the credential stealer during npm or PyPI install, then deliberately exits non-zero so the failure looks like a normal broken optional dependency. The payload relies on the Bun runtime, so endpoints with Bun pre-installed are most at risk. Anomity inventories the Bun CLI and any rogue artifacts dropped during install, and can deny the install-time tool call on agents that expose a hook before exfiltration runs. Which secrets does the stealer target, and what should I rotate? The credential stealer targets GitHub Actions OIDC tokens, GitLab and CircleCI CI/CD tokens, AWS IMDSv2, GCP and Azure cloud credentials, Kubernetes service accounts, HashiCorp Vault, and package-registry tokens. If any affected version was installed on a developer workstation, build agent, or CI runner, rotate every CI/CD and cloud credential reachable from that machine, revoke and reissue registry publish tokens, and cycle Kubernetes service-account tokens. Review your 90-day [audit trail](https://anomity.ai/#outcomes) to scope which endpoints ran the install and which identities were exposed before deciding the blast radius. Does Anomity replace my SCA scanner or EDR for this? No. Anomity complements network controls, EDR, DLP, and GRC rather than replacing them. Software-composition scanners flag the known-bad versions, and EDR watches process behavior; Anomity adds the agentic-endpoint layer by inventorying AI agents, MCP servers, extensions, skills, plugins, secrets, hooks, and CLIs - including the Bun runtime this attack depends on. On agents that expose a hook, such as Claude Code PreToolUse, it returns allow, deny, or log on each tool call before it runs, so an install-time command can be blocked. See [how it works](https://anomity.ai/#how-it-works) and [runtime governance](https://anomity.ai/#runtime-governance). ## Related [Advisory High ### Plugin4Shell - A Branch Named Like a Commit Broke Plugin SHA Pinning in Four Coding Agents Plugin4Shell let a plugin owner swap reviewed code under an intact SHA pin. Auto-update made it zero-click. Two agents patched, two never will. Anomity Research · Oct 2, 2026 · Plugin4Shell (AIR, 2026-09-17); no CVE assigned](https://anomity.ai/blog/plugin4shell-coding-agent-plugin-sha-pinning-bypass/) [Advisory High ### OpenClaw 2.0: What the Biggest Rewrite Yet Changes for Skill Supply-Chain Risk OpenClaw 2.0 landed on 30 August 2026 as the project's largest rewrite. Unit 42 and Backslash research shows the skill supply chain it inherits is still delivering malware - and our own scans separate the official skills from the ecosystem around them. Anomity Research · Sep 2, 2026 · No CVE. OpenClaw 2.0 (release notes 2026.8.1), 30 August 2026; Unit 42 skill analysis (February-May 2026); Backslash Security risk review (4 June 2026)](https://anomity.ai/blog/openclaw-2-0-security-skill-supply-chain/) [Advisory High ### MCPJacking: How Expired Domains Take Over Registry MCP Servers MCPJacking hijacks listed MCP servers by reclaiming their expired domains. AIR Security reports 155 hijackable entries in the official MCP registry. Anomity Research · Aug 29, 2026 · MCPJacking (AIR Security, August 2026; no CVE published)](https://anomity.ai/blog/mcpjacking-expired-domain-mcp-registry-hijack/) ## Structured data ```json { "@context": "https://schema.org", "@type": "TechArticle", "headline": "TanStack, Mistral AI and Guardrails AI npm/PyPI Packages Hit by Mini Shai-Hulud - CVE-2026-45321", "description": "CVE-2026-45321: the Mini Shai-Hulud wave hit 42 @tanstack packages across 84 versions plus 170+ npm/PyPI packages to steal CI/CD and cloud secrets.", "datePublished": "2026-05-11", "dateModified": "2026-05-11", "author": { "@type": "Organization", "name": "Anomity", "url": "https://anomity.ai/", "sameAs": [ "https://www.linkedin.com/company/anomity", "https://github.com/Anomity-ai", "https://www.wikidata.org/wiki/Q140763940" ] }, "publisher": { "@type": "Organization", "name": "Anomity", "url": "https://anomity.ai/", "sameAs": [ "https://www.linkedin.com/company/anomity", "https://github.com/Anomity-ai", "https://www.wikidata.org/wiki/Q140763940" ], "logo": { "@type": "ImageObject", "url": "https://anomity.ai/icon-512.png" } }, "mainEntityOfPage": { "@type": "WebPage", "@id": "https://anomity.ai/blog/tanstack-mini-shai-hulud-cve-2026-45321/" }, "image": { "@type": "ImageObject", "url": "https://anomity.ai/assets/blog/covers/skills-supply-chain.jpg", "width": 1200, "height": 630 }, "articleSection": "AI Supply-Chain Attacks", "url": "https://anomity.ai/blog/tanstack-mini-shai-hulud-cve-2026-45321/", "keywords": "Mini Shai-Hulud TanStack CVE-2026-45321, CVE-2026-45321 (GHSA-g7cv-rxg3-hmpx), supply-chain, npm, PyPI, CVE-2026-45321, Shai-Hulud, credential-theft, MCP, CI/CD" } ``` ```json { "@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [ { "@type": "Question", "name": "Which packages and versions are affected by CVE-2026-45321?", "acceptedAnswer": { "@type": "Answer", "text": "The advisory GHSA-g7cv-rxg3-hmpx enumerates 42 @tanstack packages spanning 84 malicious versions, including @tanstack/react-router 1.169.5 and 1.169.8. The same Mini Shai-Hulud wave, attributed to the actor TeamPCP, also reached packages from Mistral AI, Guardrails AI, UiPath, and OpenSearch - more than 170 packages across npm and PyPI with over 518 million cumulative downloads. Remove any affected version, reinstall from a known-good release, and treat any machine that ran an install as compromised. Because the payload activates at install time, simply pinning a clean version after the fact does not undo credential theft that already occurred." } }, { "@type": "Question", "name": "How does the install-time payload work?", "acceptedAnswer": { "@type": "Answer", "text": "A compromised tarball adds an optionalDependencies entry such as @tanstack/setup pointing to an attacker-controlled GitHub orphan commit. That dependency's package.json declares a prepare lifecycle hook (bun run tanstack_runner.js && exit 1) that runs the credential stealer during npm or PyPI install, then deliberately exits non-zero so the failure looks like a normal broken optional dependency. The payload relies on the Bun runtime, so endpoints with Bun pre-installed are most at risk. Anomity inventories the Bun CLI and any rogue artifacts dropped during install, and can deny the install-time tool call on agents that expose a hook before exfiltration runs." } }, { "@type": "Question", "name": "Which secrets does the stealer target, and what should I rotate?", "acceptedAnswer": { "@type": "Answer", "text": "The credential stealer targets GitHub Actions OIDC tokens, GitLab and CircleCI CI/CD tokens, AWS IMDSv2, GCP and Azure cloud credentials, Kubernetes service accounts, HashiCorp Vault, and package-registry tokens. If any affected version was installed on a developer workstation, build agent, or CI runner, rotate every CI/CD and cloud credential reachable from that machine, revoke and reissue registry publish tokens, and cycle Kubernetes service-account tokens. Review your 90-day [audit trail](/#outcomes) to scope which endpoints ran the install and which identities were exposed before deciding the blast radius." } }, { "@type": "Question", "name": "Does Anomity replace my SCA scanner or EDR for this?", "acceptedAnswer": { "@type": "Answer", "text": "No. Anomity complements network controls, EDR, DLP, and GRC rather than replacing them. Software-composition scanners flag the known-bad versions, and EDR watches process behavior; Anomity adds the agentic-endpoint layer by inventorying AI agents, MCP servers, extensions, skills, plugins, secrets, hooks, and CLIs - including the Bun runtime this attack depends on. On agents that expose a hook, such as Claude Code PreToolUse, it returns allow, deny, or log on each tool call before it runs, so an install-time command can be blocked. See [how it works](/#how-it-works) and [runtime governance](/#runtime-governance)." } } ] } ``` ```json { "@context": "https://schema.org", "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://anomity.ai/" }, { "@type": "ListItem", "position": 2, "name": "Blog", "item": "https://anomity.ai/blog/" }, { "@type": "ListItem", "position": 3, "name": "TanStack, Mistral AI and Guardrails AI npm/PyPI Packages Hit by Mini Shai-Hulud - CVE-2026-45321", "item": "https://anomity.ai/blog/tanstack-mini-shai-hulud-cve-2026-45321/" } ] } ```