๐The Next Web (TNW)โขStalecollected in 62m
OpenAI confirms no user data in npm worm
๐กCritical supply chain attack via CI/CD pipelines: learn how to secure your build runners against npm injection.
โก 30-Second TL;DR
What Changed
Malicious code injected via TanStack's legitimate release pipeline
Why It Matters
This highlights a critical supply chain vulnerability in modern CI/CD pipelines, forcing developers to rethink the security of third-party build runners.
What To Do Next
Audit your CI/CD pipeline configurations and restrict permissions for build runners to prevent unauthorized package publication.
Who should care:Developers & AI Engineers
Key Points
- โขMalicious code injected via TanStack's legitimate release pipeline
- โขAttackers took over the runner mid-build to publish packages
- โขOpenAI confirms zero impact on user data or credentials
๐ง Deep Insight
Web-grounded analysis with 18 cited sources.
๐ Enhanced Key Takeaways
- โขThe attack, dubbed "Mini Shai-Hulud," is part of a broader, self-propagating worm campaign that has compromised over 170 packages across npm and PyPI, impacting other major AI and software companies like Mistral AI and UiPath.
- โขThe malicious packages were published through TanStack's legitimate GitHub Actions release pipeline by exploiting a "Pwn Request" pattern, cache poisoning, and OpenID Connect (OIDC) token extraction from the runner's memory, rather than stolen npm credentials.
- โขThe compromised packages uniquely carried valid SLSA Build Level 3 provenance attestations, marking the first documented npm worm to achieve this, which complicated detection by making the malicious artifacts appear legitimate.
- โขOpenAI confirmed that while two employee devices were affected and limited credential material was exfiltrated from internal code repositories, no user data, passwords, or API keys were compromised.
- โขAs a direct consequence, OpenAI's signing keys for Windows, macOS, iOS, and Android applications were impacted, necessitating a mandatory update for macOS users by June 12, 2026, to ensure continued app functionality.
๐ ๏ธ Technical Deep Dive
- Attack Vector: Chained GitHub Actions "Pwn Request" (using
pull_request_targettrigger), cache poisoning across forkโbase trust boundary, and runtime memory extraction of an OIDC token from the GitHub Actions runner process. - Payload: Malicious packages contained a heavily obfuscated
router_init.jsfile. - Malware Capabilities: Designed to steal GitHub tokens, npm publish tokens, cloud credentials (AWS, GCP, Kubernetes), SSH keys, cryptocurrency wallets, and AI tool credentials.
- Propagation: Self-propagating worm that enumerates packages a compromised maintainer controls and publishes infected versions.
- Evasion: Malware used a "dead-man's switch" to wipe the root directory if stolen tokens were revoked (
rm -rf ~/). - Attestation: The malicious packages carried valid SLSA Build Level 3 provenance attestations, indicating the attack abused legitimate CI/CD pipelines.
- Vulnerability: Exploited broad repository-level OIDC trust and orphaned commits in forks that bypass branch protection rules.
๐ฎ Future ImplicationsAI analysis grounded in cited sources
Increased scrutiny on software supply chain security will become standard for AI companies.
The incident highlights the vulnerability of AI companies to broader open-source supply chain attacks, pushing for more robust security measures beyond internal systems.
Open-source project maintainers will face pressure to adopt more stringent CI/CD security practices.
The attack's success in compromising a legitimate release pipeline with valid attestations demonstrates a critical weakness requiring enhanced security for build processes.
The use of advanced supply chain attack techniques like OIDC token extraction and SLSA Build Level 3 attestations will become more common.
The sophistication of the Mini Shai-Hulud worm sets a new precedent for attackers, forcing defenders to anticipate more advanced and stealthy supply chain compromises.
โณ Timeline
2023-03
OpenAI experiences a ChatGPT data breach affecting 1.2% of ChatGPT Plus users.
2025-09
The original "Shai-Hulud" worm campaign begins, compromising over 500 npm packages.
2026-03
TeamPCP, later attributed to Mini Shai-Hulud, compromises Aqua Security's Trivy scanner.
2026-04
TeamPCP compromises the Bitwarden CLI npm package.
2026-04-29
A new wave, "Mini Shai-Hulud," begins targeting the SAP developer ecosystem via npm packages.
2026-05-11
The Mini Shai-Hulud worm compromises TanStack npm packages, affecting OpenAI's corporate environment.
๐ Sources (18)
Factual claims are grounded in the sources below. Forward-looking analysis is AI-generated interpretation.
- Google Search Source
- Google Search Source
- Google Search Source
- Google Search Source
- Google Search Source
- Google Search Source
- Google Search Source
- Google Search Source
- Google Search Source
- Google Search Source
- Google Search Source
- Google Search Source
- Google Search Source
- Google Search Source
- Google Search Source
- Google Search Source
- Google Search Source
- Google Search Source
๐ฐ
Weekly AI Recap
Read this week's curated digest of top AI events โ
๐Related Updates
AI-curated news aggregator. All content rights belong to original publishers.
Original source: The Next Web (TNW) โ