The software supply chain has absorbed many attacks in recent years, yet most stayed relatively contained, touching a single repository, one development ecosystem, or a limited group of organizations. Mini Shai-Hulud, operated by the threat actor group known as TeamPCP, marks a real shift. It shows how self-replicating malware can spread across several open-source ecosystems at once while reaching developers, CI/CD pipelines, and cloud-native infrastructure.
Often described as the closest known parallel to the IronWorm concept, Mini Shai-Hulud folds autonomous propagation, credential theft, package poisoning, and destructive behavior into one framework that travels across both the npm and PyPI registries. Where traditional supply chain attacks depend on manually compromising individual projects, this campaign adds worm-like behavior so that infections expand automatically once an initial foothold exists.
A multi-ecosystem operation
Researchers tracking the operation saw multiple attack waves aimed at both the JavaScript and Python communities. The campaign compromised more than 170 packages across npm and PyPI, exposing a combined ecosystem that processes hundreds of millions of downloads each week.
TeamPCP carried a consistent Dune-inspired theme through its infrastructure, malware naming, and repository activity. The branding may look cosmetic, but it gave investigators useful indicators that helped tie seemingly separate compromises into one coordinated campaign.
The scale reaches past the packages themselves. Researchers found hundreds of GitHub repositories created with stolen credentials, a sign that the attackers had automated parts of their propagation workflow. Every newly compromised account became both a victim and a launch point, which let the campaign grow at an accelerating pace. Rather than fixating on a single high-profile package, TeamPCP went after interconnected groups of related packages so that downstream developers, build systems, and deployment pipelines would be likely to encounter malicious code no matter which source they relied on.
Infection begins during installation
The attack chain is deceptively simple and highly effective. When a developer, build server, or CI/CD runner installs a compromised package, malicious code runs automatically during installation or initialization. In JavaScript environments that often happens through npm lifecycle scripts such as preinstall, install, or postinstall. In Python, execution can come through manipulated setup files, package initialization routines, dependency hooks, or import-time code. Because installing a package is treated as a trusted action in most environments, the code frequently runs without raising immediate suspicion.
Once active, the malware harvests credentials and secrets from the local system. Observed collection routines targeted a broad set of high-value material:
Modern developer workstations and CI/CD runners often hold privileged access to source repositories, artifact registries, cloud environments, and deployment pipelines. As a result, one compromised developer system can hand attackers access to multiple organizations at the same time.
Self-propagation through stolen credentials
What sets Mini Shai-Hulud apart from ordinary package malware is its ability to propagate on its own. After harvesting credentials, the malware authenticates against services the victim can reach. If it finds package publishing rights, it automatically modifies existing packages or publishes new malicious versions under legitimate accounts. That creates a self-sustaining cycle. A compromised developer installs a malicious package, the malware steals repository and publishing credentials, those credentials poison additional packages, new victims install them, and the loop repeats.
The result is a digital chain reaction that spreads through software ecosystems with no further involvement from the original operators. The supply chain itself becomes the propagation mechanism.
Operationally the malware behaves like historical worms such as the Morris Worm, Code Red, SQL Slammer, and WannaCry. The difference is the medium. Instead of exploiting network services, Mini Shai-Hulud exploits trust relationships inside modern software development infrastructure. In the most documented wave, the entry point was not a phished password or a stolen long-lived token at all. The attacker extracted a short-lived OIDC token directly from a CI runner and exchanged it for authenticated publish access to an entire package namespace, then let each infected run become the next publisher.
Why the campaign is truly cross-platform
Many campaigns claim cross-platform reach because they target several operating systems. Mini Shai-Hulud takes the idea further by operating across multiple software ecosystems at the same time. It does not lean on Windows-specific APIs, Linux vulnerabilities, or macOS exploitation. It abuses technologies common to every modern development environment.
JavaScript developers install npm packages on Windows, Linux, and macOS. Python developers rely on PyPI across the same systems. Cloud-native environments frequently use both ecosystems together. The attack surface is therefore exceptionally broad. Developer laptops, CI/CD runners, GitHub Actions workflows, GitLab pipelines, containerized build environments, Kubernetes clusters, and cloud deployment platforms can all become infection points. Because propagation is tied to package installation rather than operating system behavior, platform diversity offers little protection.
The destructive evolution
The most concerning development emerged in a major wave disclosed on May 12, 2026. Researchers identified compromises affecting numerous widely used projects and organizations, including packages tied to prominent software vendors and AI development communities, with more than 160 packages reportedly impacted during this phase.
Earlier variants focused on credential theft and propagation. This wave added destructive functionality. Analysis revealed persistent background processes able to run as long-lived daemons inside infected environments, designed to keep harvesting credentials and also to perform destructive filesystem operations. Under certain conditions the malware could attempt to delete or corrupt files in developer home directories. One particularly aggressive design detail stood out: the payload was rigged so that revoking the malicious publishing token would itself trigger the wipe routine, turning the obvious cleanup step into the thing that destroys the machine. That behavior turns a supply chain compromise into a potential sabotage event capable of disrupting development work, damaging repositories, and impairing build infrastructure, and it mirrors how other malware families have progressed from credential theft into ransomware or destruction.
The legacy of the original Shai-Hulud worm
Mini Shai-Hulud builds on concepts first shown in the original Shai-Hulud campaign of September 2025, one of the first documented examples of self-replicating malware built for the npm ecosystem. Within days, hundreds of packages were compromised as the worm moved autonomously between developer accounts and repositories, proving that package ecosystems could support worm-like propagation at internet scale.
Historically, most supply chain attacks required continuous attacker involvement, since threat actors had to compromise repositories by hand, inject code, and push updates. Shai-Hulud changed that model by automating each stage of the lifecycle. The most controversial twist came when portions of the malware source code briefly appeared on public GitHub before removal. Researchers gained the ability to study the code and build detection signatures, but the publication also opened the door to copycats. As with the release of the Mirai source code in 2016, public availability accelerated experimentation and variant development. Once autonomous propagation logic is public, attackers no longer need to build it from scratch, and Mini Shai-Hulud is one of the clearest results of that dynamic.
Implications for supply chain security
Mini Shai-Hulud points to a fundamental shift. Traditional compromises focused on infecting downstream users. Modern self-replicating package worms focus on infecting the maintainers, developers, and CI/CD infrastructure that power the ecosystem itself, which gives attackers a continuously expanding set of trusted distribution channels. The campaign also shows how interconnected development environments have become. A single workstation may hold access to GitHub repositories, package registries, Kubernetes clusters, cloud platforms, infrastructure-as-code repositories, CI/CD pipelines, secrets management systems, and production workloads, so compromising one endpoint can cascade across an entire delivery chain.
As organizations lean more heavily on open-source software and automated pipelines, self-propagating supply chain malware is likely to keep growing as a concern. Future variants may add AI assistance, automated vulnerability discovery, cloud-native lateral movement, or adaptive credential targeting to push propagation rates even higher. Mini Shai-Hulud is a reminder that supply chain attacks are no longer limited to isolated package compromises. They are becoming autonomous, ecosystem-level threats that spread across registries, operating systems, organizations, and cloud environments with very little human involvement.