Mini Shai-Hulud: CI/CD Poisoning Hit 84 npm Packages

In April 2026, a threat actor codenamed Mini Shai-Hulud compromised the TanStack open-source project and published 84 malicious npm packages. The attack did not exploit a zero-day or a novel cryptographic weakness. It poisoned the CI/CD pipeline itself — turning GitHub Actions into a publication weapon.

What Happened

TanStack maintains some of the most widely used libraries in the React ecosystem — Table, Router, Query, Form, and Virtualizer. On April 28, 2026, the TanStack team confirmed that their @tanstack npm scope had been compromised. Eighty-four packages carrying that trusted scope were published with malicious payloads.

The attacker did not steal npm credentials directly. They exploited the CI/CD pipeline that was authorized to publish on the maintainer's behalf. — Socket.dev

This distinction matters. Most supply-chain defenses focus on verifying package integrity. Fewer focus on verifying the pipeline that produced the package. Mini Shai-Hulud turned the automation layer — the very mechanism meant to guarantee build reproducibility — into the attack vector.

How the Attack Chain Works

The attack exploits a well-documented weakness in GitHub Actions: the pull_request_target event trigger. Unlike pull_request, which runs in the context of the fork, pull_request_target runs workflows from the base repository with access to the repository's secrets.

Here is the three-stage chain the attacker assembled:

Stage 1: Malicious Pull Request

The attacker forked a TanStack repository, modified a workflow file to inject code that runs during CI, and submitted a pull request. Because TanStack's release workflows used pull_request_target, the malicious code executed with access to the repository's secrets — including the OIDC token used for npm authentication.

Stage 2: Cache Poisoning

The injected code wrote attacker-controlled content into the GitHub Actions cache. When a legitimate maintainer later triggered a release workflow, it pulled the poisoned cache entries. The result: the official release pipeline published packages that contained attacker code — all signed under the @tanstack scope, all appearing legitimate.

Cache poisoning means the attacker never needs to touch the source code directly. They corrupt the build artifact at a stage where few teams have inspection controls. — Socket.dev

Stage 3: OIDC Token Theft and Publication

The compromised workflow extracted the OIDC token — a short-lived credential that GitHub generates for trusted publishers to authenticate with npm without storing long-lived tokens. With that token, the attacker published 84 malicious packages directly to the @tanstack npm scope.

Any project that depended on @tanstack/router, @tanstack/table, or the other affected packages pulled the malicious version during npm install. No integrity check flagged it. The package was signed, scoped, and published from an authorized pipeline.

Why Existing Defenses Missed It

Most npm supply-chain protections assume the threat model is "attacker publishes a lookalike package" or "attacker steals maintainer credentials." Mini Shai-Hulud operates in a different layer:

Defense	What It Catches	What It Missed Here
Package signing (Sigstore)	Tampered artifacts	Artifact was legitimately signed by the authorized pipeline
Scope protection	Unscoped name squatting	Packages were under the legitimate @tanstack scope
Lockfile pinning	Unexpected version bumps	Users who ran npm update pulled the new "latest"
npm provenance	Unsigned packages	Provenance attested to a real CI run — a compromised one

Provenance tells you where a package was built. It does not tell you whether the build was clean. A compromised pipeline produces packages with valid provenance and valid signatures. The trust anchor is the pipeline itself, not the artifact.

The Broader Campaign

Mini Shai-Hulud is not a single incident. The threat actor has been active since at least early 2026, targeting both npm and PHP/Composer ecosystems. On the PHP side, the campaign spread to Packagist through compromised Intercom packages, using similar CI/CD poisoning techniques adapted for GitHub Actions workflows in PHP projects.

The campaign pattern — fork, inject, cache-poison, publish — is repeatable across any ecosystem that uses CI/CD pipelines with overly permissive pull_request_target configurations and cache mechanisms that lack content-addressable verification.

How AI Can Assist

AI is not a silver bullet for supply-chain security. But applied to the specific failure modes Mini Shai-Hulud exploits — pipeline misconfiguration, subtle code injection, and provenance gaps — it offers detection and response capabilities that manual review cannot scale to.

AI-Powered Workflow Analysis

GitHub Actions workflow files are YAML — complex, dynamic, and easy to misconfigure. An LLM fine-tuned on pull_request_target misuse patterns can flag dangerous trigger configurations before they merge. Tools like Socket's package analysis already use pattern matching, but LLM-based review adds semantic understanding: it can trace data flow through env interpolations, uses action chains, and conditional execution branches that simple pattern matchers miss.

Anomaly Detection in CI Behavior

An AI model trained on normal release pipeline behavior can detect deviations: unexpected npm publish calls in a PR-check workflow, cache writes from unreviewed forks, or OIDC token usage in workflows not tied to a release event. These signals are subtle — they require correlating workflow name, trigger type, and secrets access — and they are exactly the kind of pattern recognition where transformer models outperform rule-based systems.

Sandboxing and Provenance Verification

AI-driven sandboxing — running CI steps in observed environments and comparing actual behavior to expected behavior — catches the gap between "this pipeline has valid provenance" and "this pipeline did what we expect." After the TanStack incident, npm's automated publish protection now blocks releases from projects with recent suspicious workflow changes, but AI can go further by continuously verifying that each CI run matches an expected behavior profile.

Automated Incident Triage

When an attack surfaces, the window for containment is hours, not days. AI systems that ingest advisory feeds, correlate package version anomalies across registries, and prioritize alerts based on blast radius shrink response time. In the TanStack case, an automated system could have flagged the 84-package publication burst as anomalous within minutes.

What Teams Should Do Now

Regardless of AI tooling adoption, several immediate mitigations address the specific attack vectors Mini Shai-Hulud exploits:

Longer-Term Hardening

Beyond immediate mitigations, teams should adopt supply-chain threat modeling that accounts for pipeline compromise as a first-class threat, not just credential theft. That means:

• Build provenance verification that goes beyond "was this signed?" to "does the CI run match our expected pipeline definition?" — comparing the actual workflow YAML that ran against the one in the repository's default branch.
• Signed build policies (SLSA Level 3+) that require hermetic builds with no external network access during compilation, eliminating the opportunity for cache-poisoned artifacts to phone home.
• Dependency pinning with verification — not just version pinning, but integrity verification of every transitive dependency at each install.

The Real Lesson

Mini Shai-Hulud is not a story about npm being insecure. It is a story about CI/CD becoming the new perimeter. For years, security teams have hardened package registries, added signing, and built provenance systems. Those measures work — for the threats they were designed to stop. But the threats have moved upstream.

The pipeline that builds and publishes your packages is now the highest-value target. A compromised pipeline produces packages that pass every integrity check because the pipeline is the trusted actor. Defending against that requires a different mental model — one where trust is not just verified at the artifact level, but continuously validated at the process level.

The attacker did not break npm. They broke the process that npm trusts. The fix is not stronger locks on the registry door — it is harder locks on the publishing pipeline itself.

AI can help with the detection and triage layers, but the architectural fix is structural: CI/CD pipelines must be treated as privileged infrastructure, not automation conveniences. Every workflow that can publish a package should require human approval, run from immutable definitions, and produce artifacts verifiable against a known-good baseline.

The TanStack team responded within hours, yanking all 84 packages and issuing advisories. Their postmortem — a model of transparent disclosure — is worth reading for any maintainer who runs npm publish from CI. But the next attack will target a different popular project with the same playbook. The question is whether the pipeline will be ready.