VulnHub

Real-time Cybersecurity News

TeamPCP Used Mini Shai-Hulud Worm to Poison Over 400 npm and PyPI Packages

Hackread – Cybersecurity News, Data Breaches, AI and More
Actively Exploited
Malware

Overview

Researchers have discovered that a group known as TeamPCP hijacked OpenID Connect (OIDC) tokens, allowing them to inject a self-replicating worm named Mini Shai-Hulud into over 400 packages on popular repositories like npm and PyPI. This attack specifically targeted packages associated with TanStack, Mistral AI, and UiPath, potentially compromising users who utilize these libraries in their projects. The worm's ability to propagate itself means it could continue to spread, affecting an even wider range of applications. This incident raises serious concerns about the security of software supply chains and the need for developers to remain vigilant about the packages they use. Users and companies relying on these affected packages should take immediate action to verify their dependencies and ensure their systems are secure.

Key Takeaways

  • Active Exploitation: This vulnerability is being actively exploited by attackers. Immediate action is recommended.
  • Affected Systems: TanStack, Mistral AI, UiPath packages on npm and PyPI
  • Action Required: Users should verify their dependencies, update to the latest versions of affected packages, and consider implementing additional security measures such as dependency scanning.
  • Timeline: Newly disclosed

Original Article Summary

Research reveals that TeamPCP hijacked OIDC tokens to poison hundreds of TanStack, Mistral AI, and UiPath packages with the self-propagating Mini Shai-Hulud worm.

Impact

TanStack, Mistral AI, UiPath packages on npm and PyPI

Exploitation Status

This vulnerability is confirmed to be actively exploited by attackers in real-world attacks. Organizations should prioritize patching or implementing workarounds immediately.

Timeline

Newly disclosed

Remediation

Users should verify their dependencies, update to the latest versions of affected packages, and consider implementing additional security measures such as dependency scanning.

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Related Topics: This incident relates to Malware.

Read Original Article

Related Coverage

China-Linked Twill Typhoon Uses Fake Apple and Yahoo Sites for Espionage

Hackread – Cybersecurity News, Data Breaches, AI and More

A recent report from Darktrace reveals that a group of Chinese hackers, known as Twill Typhoon, is using counterfeit websites mimicking Apple and Yahoo to conduct espionage. These fake sites are designed to lure unsuspecting users into providing sensitive information, which the attackers can then leverage for spying on various organizations. The hackers are utilizing a malware framework called FDMTP, which further aids their operations. This tactic poses a significant risk to individuals and companies who may mistakenly trust these fraudulent sites, potentially leading to data breaches and compromised security. Organizations are urged to remain vigilant and educate their employees about the dangers of phishing and counterfeit websites.

May 14, 2026

Hackers Targeted PraisonAI Vulnerability Hours After Disclosure

SecurityWeek

Hackers began exploiting a newly discovered vulnerability in PraisonAI within hours of its public disclosure. This flaw allows attackers to bypass authentication measures, potentially granting unauthorized access to sensitive data. The rapid response from malicious actors indicates a high level of interest in exploiting this weakness, which could affect numerous users and organizations relying on PraisonAI's services. Companies using this technology should take immediate steps to secure their systems to prevent unauthorized access and data breaches. The quick exploitation attempts serve as a reminder of the urgency in addressing newly disclosed vulnerabilities.

May 14, 2026

Most Organizations Now Use AI Agents for Sensitive Security Tasks

Infosecurity Magazine

A recent study by Semperis indicates that 74% of organizations are concerned that artificial intelligence (AI) will lead to more attacks on their identity infrastructure. As companies increasingly rely on AI agents for sensitive security tasks, there are growing worries about how these technologies might be exploited by attackers. The research suggests that while AI can enhance security measures, it also presents new vulnerabilities that cybercriminals may try to exploit. This trend raises important questions for businesses about how to balance the benefits of AI with the potential risks it introduces. Organizations will need to take proactive steps to secure their identity systems against these emerging threats.

May 14, 2026

FamousSparrow targets Azerbaijani energy sector in multi-wave espionage campaign

Security Affairs

A Chinese-linked hacking group known as FamousSparrow has targeted an Azerbaijani oil and gas company in a series of espionage attacks. The group repeatedly exploited the same entry point for three separate intrusions between December 2025 and February 2026. These attacks are part of a broader campaign aimed at gathering intelligence from the energy sector, which is vital for Azerbaijan's economy. The repeated access indicates a level of persistence and sophistication in their approach, raising concerns about the security measures in place to protect critical infrastructure. This situation underscores the ongoing risks that state-sponsored actors pose to national energy resources and the need for enhanced cybersecurity protocols in the sector.

May 14, 2026

Researcher Drops YellowKey, GreenPlasma Windows Zero-Days

SecurityWeek

A security researcher has disclosed two serious vulnerabilities in Windows, known as YellowKey and GreenPlasma. YellowKey is a BitLocker bypass that allows unauthorized access to encrypted drives, but it requires physical access to the device. GreenPlasma, on the other hand, enables attackers to elevate their privileges to System level, potentially giving them full control over the affected system. These vulnerabilities pose a significant risk to users and organizations that rely on Windows for sensitive tasks. Companies should assess their physical security measures and apply necessary updates to protect against these risks.

May 14, 2026

New Fragnesia Linux Kernel LPE Grants Root Access via Page Cache Corruption

The Hacker News

A new variant of a local privilege escalation vulnerability in the Linux kernel, named Fragnesia, has been identified. This vulnerability, tracked as CVE-2026-46300 with a CVSS score of 7.8, allows local attackers to gain root access through page cache corruption. This marks the third such vulnerability discovered in the Linux kernel within just two weeks, raising concerns for users and administrators. The flaw is rooted in the kernel's XFRM component, which is responsible for managing IPsec protocols. This means that systems using affected kernel versions could be at risk if not addressed promptly, as attackers could exploit this vulnerability to gain elevated privileges and potentially take control of vulnerable systems.

May 14, 2026