An npm supply chain attack that crossed three open-source ecosystems and shipped the whole way with valid SLSA Build Level 3 provenance, the standard federal procurement leans on, is now an open-source project on GitHub. The group behind it, TeamPCP, published the Mini Shai-Hulud worm’s full source code on May 12, the day after compromising TanStack.
The supply chain attack story is no longer about who got hit. It is about what the defenders thought they had locked down, and didn’t.
The 72-Hour Cascade
TeamPCP started with SAP. On April 29 between 09:55 and 12:14 UTC, four official npm packages from SAP’s JavaScript and cloud-application development line were compromised: @cap-js/sqlite, @cap-js/postgres, @cap-js/db-service, and mbt, the npm-distributed Cloud MTA Build Tool used to deploy SAP cloud applications. Each carried a malicious preinstall script that ran during dependency install.
Socket flagged the malicious SAP mbt package, the npm-distributed Cloud MTA Build Tool, as known malware. Source: Socket.The next day the worm jumped ecosystems. PyTorch Lightning’s PyPI release for April 30 (version 2.6.2) carried a credential-stealing payload that downloaded the Bun JavaScript runtime and executed an 11 MB obfuscated harvester. By that afternoon, the npm intercom-client (versions 7.0.4 and 7.0.5) was tainted. Hours later, the Packagist build of intercom/intercom-php (5.0.2, twenty million lifetime downloads) carried the same payload. A Security Boulevard writeup reported credentials exposed across more than 1,800 developer repositories.
This is the same registry-trust mechanism North Korean operators leveraged on Axios npm earlier in April, and the same wormable propagation pattern Socket flagged in the CanisterSprawl disclosure at the end of April. Each attack escalates the previous one.
Valid Provenance, Compromised Pipeline
SLSA Build Level 3 is the highest-confidence provenance standard for software integrity. It is the layer federal procurement leans on. CNSA 2.0 references it. FedRAMP guidance points at it. The promise: if you trust the build environment and verify the provenance attestation, you trust the artifact.
Public research reported that later Mini Shai-Hulud packages were published with valid SLSA Build Level 3 provenance attestations. Public research showed that provenance checks can still pass when the trusted publishing pipeline itself is compromised, which is what happened here.
What Federal Contractors Pulled
Feross Aboukhadijeh, Socket’s CEO, told Laterstack that federal contractors who pulled the tainted packages between late April and mid-May need to treat the exposure as build-environment-wide, not dependency-tree-wide.
“If a federal contractor pulled a tainted package into dev, CI, or a build environment, the exposure may include npm tokens, PyPI credentials, GitHub credentials, cloud secrets, and CI/CD credentials,” Aboukhadijeh said. “The meaningful remediation is token rotation, build environment review, artifact cache review, and confirmation that no follow-on publishing activity occurred.”
That is the supply chain attack consequence the trade press has largely skipped on the federal procurement side. A clean dependency tree does not guarantee a clean build environment, and a clean build environment in early May 2026 cannot be assumed.
What It Means For The Apps You Use
SAP’s Cloud MTA Build Tool deploys the back-office systems that handle payroll, HR records, and supply chain logistics for thousands of companies. PyTorch Lightning is the framework that trains AI models for products consumers use every day, from voice assistants to enterprise chatbots. The intercom-client and intercom-php packages power customer support chat across thousands of consumer-facing apps.
If you spoke to a customer service bot in late April, or used a workplace platform built on SAP, the infrastructure you touched may have flowed through code compromised by Mini Shai-Hulud. The harvested credentials open the door to follow-on attacks against the companies running those services, not just the developers who built them.
A supply chain attack on developer infrastructure becomes a consequence for the people who use the products that infrastructure builds. The trade press misses that line.
TeamPCP Open-Sourced the Worm
On May 12, the day after the TanStack compromise was disclosed, TeamPCP published the full Mini Shai-Hulud worm source code to a public GitHub repository. Installation documentation included.
The supply chain attack threat surface has changed. The attack mechanism is now portable to any registry where stolen maintainer credentials can publish trusted updates. PyPI, npm, Packagist, Cargo, Maven, RubyGems. Any registry that respects maintainer ownership is a candidate.
The Defenders Were Faster
Socket flagged the malicious PyTorch Lightning release 18 minutes after publication. The Lightning AI community pulled the compromised versions and shipped a clean release within 42 minutes total. Lightning’s postmortem named Socket’s contribution directly: “vulnerability scanning services including socket.dev also detected the attack, reported to us on GitHub and Discord, and published detailed technical analysis that aided our response.”
Aboukhadijeh told Laterstack that PyTorch Lightning’s handling is “pretty much the gold standard for disclosure.” Lightning disclosed fast to its open-source community and followed with a transparent postmortem that named the researchers who helped, including Socket. That is what a good-faith response to a compromise looks like.
That counter-story is what federal procurement should be funding, not just provenance.
The Prediction
Provenance was the federal procurement bet. Provenance failed. The next bet has to be runtime detection and rapid community response, the two things that actually caught Mini Shai-Hulud.
What this means for the everyday person buying apps or using a customer service chatbot is that the security of the software you use every day depends on a small set of dedicated research teams catching attacks faster than attackers can iterate. The worm’s source code is now public, but these groups change tactics with every wave, which means any published analysis of how this one worked is already dated by the time the next campaign lands. You don’t write this defense as a playbook once. It comes down to a small set of research teams catching each new variant faster than the last. The cycle is accelerating in both directions.
Watch the next FedRAMP and CNSA guidance updates. The supply chain attack defense doctrine is about to shift.
Frequently Asked Questions
What is Mini Shai-Hulud?
Mini Shai-Hulud is a self-propagating worm developed by the threat group TeamPCP. Between April 29 and May 12, 2026, it compromised packages across the npm, PyPI, and Packagist ecosystems, harvested developer credentials and cloud secrets, and used those credentials to publish further malicious package versions. TeamPCP published the worm’s source code on GitHub on May 12.
Who is TeamPCP?
TeamPCP is a financially motivated threat group tracked publicly since late 2025. Google Threat Intelligence Group tracks the group as UNC6780. Other observed aliases include DeadCatx3, PCPcat, ShellForce, and CipherForce. Prior campaigns hit LiteLLM, Telnyx, and Xinference before the Mini Shai-Hulud cascade.
What is SLSA Build Level 3 and why does it matter here?
SLSA Build Level 3 is the highest-confidence software provenance standard maintained by the Open Source Security Foundation. It certifies that an artifact was built in a hardened, auditable environment with verified provenance attestations. CNSA 2.0 and FedRAMP guidance reference it. Mini Shai-Hulud packages were published with valid SLSA Build Level 3 provenance attestations. Public research showed that provenance checks can still pass when the trusted publishing pipeline itself is compromised, which is what happened here.
What should federal contractors do who pulled tainted packages?
Per Socket: treat the exposure as build-environment-wide. Rotate npm, PyPI, GitHub, cloud, and CI/CD tokens. Review the build environment, the artifact cache, and any follow-on publishing activity from the compromised window.