Mass NPM & PyPI Supply Chain Attack Hits TanStack, Mistral AI, and 170+ Packages
On May 11, 2026, a coordinated supply chain attack compromised over 170 npm packages and 2 PyPI packages across major projects including TanStack, Mistral AI, UiPath, OpenSearch, and Guardrails AI. The attacker published 404 malicious versions total, with some packages receiving up to 9 versions.
High-Profile Targets
- TanStack (42 packages, 84 versions): Entire router ecosystem including
@tanstack/react-router,@tanstack/vue-router, and@tanstack/solid-routeralongside their devtools and SSR plugins. - Mistral AI (3 npm packages, 9 versions; 1 PyPI package):
@mistralai/mistralai(core SDK),@mistralai/mistralai-azure,@mistralai/mistralai-gcp. PyPI packagemistralai==2.4.6(legitimate latest was 2.4.5). - UiPath (65 packages) and OpenSearch (1.3M weekly npm downloads).
- PyPI:
guardrails-ai==0.10.1also compromised.
How the Attack Works
The npm packages contain a malicious preinstall hook that drops files into .claude/settings.json, .claude/setup.mjs, .vscode/tasks.json, and .vscode/setup.mjs. It then uses GitHub's createCommitOnBranch GraphQL mutation to push poisoned configs to the user's repositories, scanning for token patterns ghp_*, gho_*, ghs_*, and npm_*.
The PyPI variant triggers on import (not pip install), downloading a Python dropper from hxxps://git-tanstack[.]com/transformers.pyz and executing it with python3 /tmp/transformers.pyz.
Indicators of Compromise (IoCs)
- C2/Exfiltration:
hxxp://filev2[.]getsession[.]org/file/ - AWS metadata probe:
hxxp://169[.]254[.]169[.]254/latest/meta-data/iam/security-credentials/ - Vault probe:
hxxp://127[.]0[.]0[.]1:8200 - Bun runtime download:
hxxps://github[.]com/oven-sh/bun/releases/download/bun-v1.3.13/ - PyPI download domain:
hxxps://git-tanstack[.]com/transformers.pyz(Cloudflare-flagged as phishing)
Mitigation
Check your package-lock.json or yarn.lock for the affected versions. Block the listed domains in your firewall. Rotate any tokens that may have been exposed. PyPI has quarantined both mistralai and guardrails-ai projects.
📖 Read the full source: HN AI Agents
👀 See Also
AI Agent Security: Beyond Jailbreaks to Tool Misuse and Prompt Injection
AI agents that browse the web, execute commands, and trigger workflows face security risks from prompt injection and tool misuse, where untrusted content redirects legitimate tools like shell execution and HTTP requests.
Sieve: Local Secret Scanner for AI Coding Tool Chat Histories
Sieve scans Cursor, Claude Code, Copilot, and other AI coding assistant chat histories for leaked API keys and tokens. All scanning is local, with redaction and macOS Keychain vault.
Security audit reveals vulnerabilities in OpenClaw skill ecosystem
A security audit of OpenClaw found 8 documented CVEs including arbitrary code execution and credential theft vulnerabilities, plus 15% of skills in the shared library exhibit suspicious network behavior. The auditor migrated to a minimal Rust-based runtime with Ollama for better isolation.
