Sophisticated npm Supply Chain Attack Targets OpenSearch, ElasticSearch, and DevOps Tools A recently uncovered npm supply chain attack has targeted developers working with OpenSearch, ElasticSearch, and DevOps tooling, stealing cloud credentials and CI/CD secrets from compromised systems. The campaign, attributed to a threat actor using the alias vpmdhaj, involved 14 malicious packages published on May 28, 2026, within a four-hour window. The attackers employed typosquatting and metadata spoofing, mimicking legitimate libraries with names like opensearch-setup and elastic-opensearch-helper while falsely linking to the official OpenSearch GitHub repository. To appear credible, the packages were assigned inflated version numbers, suggesting maturity and widespread use. Upon installation, the malicious packages executed code via npm preinstall scripts, triggering automatically without user interaction. The attack employed a two-stage payload system: - Early versions used a JavaScript stager to collect system details (hostname, OS, Node.js version, environment variables) and send them to a command-and-control (C2) server. The server responded with a compressed binary payload, identifiable by the “X-Supply: 1” HTTP header in network logs. - Later variants improved stealth by eliminating direct C2 communication, instead downloading the Bun runtime from GitHub to execute an embedded second-stage payload. This reduced suspicious outbound traffic and evaded traditional detection. The second-stage payload, a Bun-compiled binary, targeted credentials across multiple platforms, including: - Amazon Web Services (AWS) – Extracting environment variables, querying EC2 Instance Metadata Service and ECS task metadata, and enumerating secrets in AWS Secrets Manager. - HashiCorp Vault – Harvesting tokens. - GitHub Actions & npm – Validating publish tokens to hijack package maintainers and propagate further supply chain attacks. A persistence mechanism ensured the payload re-executed whenever the malicious module was imported, allowing it to survive across development cycles and CI/CD pipeline runs. The impact of the campaign is severe: - Stolen AWS credentials could enable lateral movement in cloud environments. - Compromised CI/CD tokens may allow attackers to manipulate build pipelines or inject malicious code into production. - Hijacked npm publish tokens pose a risk of malicious updates to legitimate packages, expanding the attack’s reach. Following responsible disclosure, the malicious packages and associated accounts were removed from the npm registry. However, organizations that installed these dependencies remain at risk. Security teams are urged to audit systems for affected packages, rotate exposed credentials, and monitor for indicators of compromise, including the “X-Supply: 1” header and unusual CloudTrail activity. The incident underscores the growing sophistication of supply chain attacks, where trusted ecosystems like npm are exploited to gain access to sensitive cloud and development infrastructure.

Massive Supply Chain Breach Hits 84 npm Packages in TanStack Ecosystem A sophisticated supply chain attack compromised 84 npm packages within the widely used TanStack ecosystem, including high-profile libraries like React Router (12M+ weekly downloads). The breach, part of the Mini Shai-Hulud malware campaign, targeted continuous integration (CI) environments such as GitHub Actions, injecting a credential-stealing tool designed to evade detection. Security firm Socket detected the malicious packages within six minutes of publication using an AI-powered scanner. The attack extended beyond npm, infecting Python packages like OpenSearch, Mistral AI, Guardrails AI, and UiPath. A message left by the attackers signed TeamPCP confirmed they had been exfiltrating developer credentials for hours during the investigation. ### Attack Mechanics The malware, embedded in an obfuscated script (router_init.js), acted as a self-propagating worm. Key tactics included: - Stealth Execution: Detached from terminal sessions, running silently in the background. - Credential Harvesting: Targeted GitHub Actions tokens, AWS metadata, Kubernetes certificates, and HashiCorp Vault clusters. - Persistence: Hid copies in VS Code and Claude AI config directories, ensuring reinfection on workspace reopening. - Exfiltration: Used the Session peer-to-peer network to blend stolen data with encrypted messaging traffic. The attack leveraged a malicious `optionalDependencies` block in package.json, pointing to a compromised GitHub commit. During `npm install`, a `prepare` lifecycle hook executed tanstack_runner.js, triggering the payload. ### Chained GitHub Actions Exploit TanStack’s postmortem revealed the breach stemmed from a chained attack on their GitHub Actions pipeline. Attackers exploited a vulnerable pull request target pattern, poisoning the workflow cache to execute malicious code. Instead of stealing static npm tokens, they extracted runtime OpenID Connect tokens from runner memory, enabling legitimate authentication to push compromised updates. ### Response & Indicators of Compromise (IOCs) TanStack deprecated affected versions, purged workflow caches, and implemented stricter repository protections. Key IOCs include: - Malicious Files: - `router_init.js` (SHA256: `ab4fcadaec49c03278063dd269ea5eef82d24f2124a8e15d7b90f2fa8601266c`) - `tanstack_runner.js` (SHA256: `2ec78d556d696e208927cc503d48e4b5eb56b31abc2870c2ed2e98d6be27fc96`) - Network Targets: - `hxxp://filev2[.]getsession[.]org/file/` (Session P2P exfiltration) - AWS metadata endpoints (`169.254.169.254`, `169.254.170.2`) - GitHub API (`api.github.com/repos/`) and npm token validation endpoints.

Mistral AI Suffers Data Breach: 450 Repositories Stolen and Auctioned on Dark Web The hacking group TeamPCP has stolen 450 internal repositories totaling 5GB of source code from Mistral AI, a leading AI development company. The stolen data, which includes code used for training, fine-tuning, benchmarking, and model delivery, is now being auctioned on the dark web for $25,000. TeamPCP, which previously executed a supply chain attack called Mini Shai-Hulud against the TanStack npm package (a widely used UI toolkit with 177 million weekly downloads), distributed infostealer malware to harvest developer credentials, cloud secrets, and SSH keys. The group claims the stolen Mistral AI data contains experimental and future project materials and has warned that if no buyer emerges within a week, they will leak the entire dataset for free. Mistral AI confirmed the breach, stating that attackers compromised a codebase management system and briefly contaminated some SDK packages. However, the company emphasized that core systems, hosted services, user data, and research environments remained unaffected. The auction is exclusive to a single buyer, with TeamPCP even inviting Mistral AI to purchase the data back. The group has indicated that the $25,000 price is negotiable. The incident highlights ongoing risks in AI development supply chains and the potential exposure of proprietary model training materials.