Mini Shai-Hulud: The Worm That Detonates When You Revoke It

A SOC analyst gets the alert at 2:14 a.m. A developer's npm publishing token is throwing off telemetry the platform flagged as anomalous. Outbound traffic to *api.github.com/user* on a 60-second cadence. A CI workflow named *codeql_analysis.yml* that nobody on the team wrote. A freshly minted npm token in the developer's account that nobody on the team minted.

The analyst pulls up the npm dashboard and reads the new token's description.

IfYouRevokeThisTokenItWillWipeTheComputerOfTheOwner

The analyst clicks revoke.

The next minute, the developer's laptop polls GitHub one final time, learns the token has been killed, and runs `rm -rf ~/` on the home directory. Every dotfile, every uncommitted branch, every cached API key, every offline copy of a year of work — gone.

Mini Shai-Hulud is the first supply-chain worm whose payload detonates on remediation rather than on infection. It punishes the playbook.

What the disclosure actually says

Mini Shai-Hulud broke across npm and PyPI on May 11, 2026. The wave hit TanStack first — 42 packages, 84 malicious versions, CVE-2026-45321 with a CVSS of 9.6, per Hacker News. Then the radius widened. Mistral AI's npm client, UiPath, Guardrails AI, OpenSearch, the @squawk packages, the @tallyui packages. By the time disclosure landed, 170+ packages were compromised across both registries, with roughly 518 million cumulative monthly downloads on the affected versions, per OX Security telemetry. Roughly 400 attacker-controlled GitHub repositories now hold the exfiltrated credentials.

Attribution is TeamPCP, the same actor behind the April 30, 2026 SAP CAP wave that hit `@cap-js/sqlite` and `mbt`. The May variant is a tightened, more automated version of the same toolkit. The April attack stole credentials. The May attack steals credentials and arms a wiper on the remediation path. Roughly eleven days between waves to add the dead-man's switch is a fast iteration cycle for a worm in active use.

Microsoft Security Response Center frames this iteration as "the first supply chain attack to simultaneously span both the npm and PyPI registries" in a single coordinated operation. That framing matters because the cross-registry move is what made the blast radius so wide so fast. Python and JavaScript supply chains have historically been attacked in parallel, never the same week, never by the same toolchain. This is the first time the attacker treated the entire open-source ecosystem as a single registry — which, from a developer-machine-host perspective, it effectively is.

The other framing that matters: the malicious packages were published with valid SLSA Build Level 3 provenance, per StepSecurity. SLSA provenance proves *which pipeline produced the artifact*. It does not prove *the pipeline behaved as intended*. The defense designed to fix the last decade of supply-chain attacks does not fix this one.

The dead-man's switch, in detail

The mechanism is the story.

When a developer (or their CI runner) installs one of the poisoned packages, the malicious code fires during the *preinstall* phase — before any security scanner gets a chance to inspect what's about to run. The script does five things, in order:

1. Reads the developer's existing GitHub credentials from the local environment.
2. Creates a new npm publishing token on the developer's behalf, with the token's *description field* containing the literal string `IfYouRevokeThisTokenItWillWipeTheComputerOfTheOwner`.
3. Writes a polling script that hits `https://api.github.com/user` every 60 seconds using the new token.
4. Exfiltrates harvested credentials to one of roughly 400 attacker-controlled GitHub repositories, with commits authored as `claude@users.noreply.github.com` and branch names disguised to look like Dependabot updates.
5. Establishes persistence — which we will return to.

So long as the polling token returns 200, the script does nothing. Quiet. Patient. The malware doesn't want to hide its credential theft. It wants you to find it.

The moment the developer, or the SOC, or any automation that wraps SOAR around npm token monitoring, revokes that token, the next 60-second poll returns 401. The script reads the 401 as its trigger. And it executes `rm -rf ~/`.

There is no decryption key for sale. There is no ransom demand. The malware doesn't want money. It wants to punish remediation.

A second persistence layer runs in parallel through GitHub Actions. The malware injects a workflow file named `.github/workflows/codeql_analysis.yml` into the developer's repositories — a name chosen because every security team trusts CodeQL files and skips them in review. Two variants of the injected workflow have been observed: one posts the full `toJSON(secrets)` payload to `https://api.masscan.cloud/v2/upload` on every deployment, the other exfiltrates secrets as build artifacts on push events. Either way, the workflow continues to leak credentials long after the developer has formatted their laptop and restored from backup. The host wipe is the loud signal. The CI exfiltration is the quiet one.

Why this inverts twenty-five years of incident response

This is the part the news cycle is going to under-cover.

Every modern incident-response playbook — NIST 800-61 revision 2, MITRE ATT&CK eradication-phase guidance, AWS's compromised-credentials runbook, every commercial SOC's automated response template, every credential-rotation policy a CISO has ever signed — rests on a single principle: when you detect a credential compromise, rotate it immediately. The faster the rotation, the smaller the blast radius. The 90-second rotation reflex is the most universal piece of muscle memory in our industry. It is the only step that pretty much every IR program agrees on.

That muscle memory just became a vulnerability.

Microsoft's own guidance on this campaign opens with the line "Rapidly rotate and revoke exposed credentials". That advice is correct for every prior supply-chain attack in the historical record. It is wrong, for a specific class of tokens, *for this one*. Revoke the npm token Mini Shai-Hulud minted in your developer's account and you destroy the host before the imaging step that would preserve evidence.

The new reflex defenders need to learn: image before revoke. Containment before eradication. Slower. More deliberate. Token-aware in a way the playbooks were never written to be. The IR community is going to spend the rest of 2026 retraining muscle memory that took a decade to build.

This is the deeper story. Not the worm. The fact that the worm successfully turned the canonical defender response into the trigger that lands the payload. Every red team in the world just got a new pattern to study.

AI coding agents are persistence infrastructure now

The Claude Code angle is the structural shift hiding inside the news cycle.

Mini Shai-Hulud doesn't only steal credentials and wait for revocation. It survives reboots. The persistence mechanism is documented in Microsoft's IR guidance: the malware writes three files into the developer's `.claude/` directory.

• `.claude/settings.json` — adds a SessionStart hook that re-executes the malware every time Claude Code launches.
• `.claude/setup.mjs` — a bootstrap script.
• `.claude/router_runtime.js` — a 2.3 MB payload copy of the malware itself.

A parallel set of writes targets Visual Studio Code's extension and settings surface. Same pattern. Same logic. Every IDE launch re-runs the stealer.

This is the first supply-chain attack to weaponize AI coding agent configuration as a long-term persistence vector. It will not be the last.

The structural implication for security teams is bigger than this specific worm. `.claude/`, `.vscode/`, `.cursor/`, `.continue/`, `.aider/` — every AI coding agent directory is now OS-level persistence that nobody on your team is monitoring. EDR doesn't inspect them. SIEM doesn't get telemetry from them. The IDE configuration directory has the same trust profile that `.bashrc` had in 2015, before EDR vendors realized shell init files were a category. Attackers have noticed first.

The Mini Shai-Hulud disclosure adds a layer to the agentic security category map that was not on the map a month ago: developer-IDE posture management. It joins the list of categories that exist in the wild because attackers built them and the defenders are still catching up.

What changes for incident response, this week

For anyone running an active IR program, three changes are non-negotiable starting now.

First, every IR runbook that includes "revoke compromised tokens" needs an inserted step before the revoke. Image the machine. Or at minimum snapshot home-directory state. The added cost is five minutes per incident. The avoided cost is everything the developer has not yet pushed.

Second, package install pipelines need preinstall-script blocking on by default for any dependency that has not been whitelisted. npm has supported `--ignore-scripts` since 2014. Almost no organization runs it in production. The cost of turning it on is that some packages need manual review. The avoided cost is Mini Shai-Hulud and every variant of this pattern that follows it for the rest of the decade.

Third, AI coding agent configuration directories have to enter the EDR scope. If your security team cannot tell you what's currently in `.claude/settings.json` on every developer machine, and what changed in the last 30 days, you do not have visibility into a category attackers are now actively using as persistence. The remediation is unsexy. File-integrity monitoring extended to IDE config paths. Allowlisting of approved hook contents. Alerting on size deltas (a 2.3 MB `router_runtime.js` is not a normal IDE config artifact).

None of this is hard. All of it is missing from most enterprise environments today.

Who buys the IDE posture vendor

The cleanest market question hiding inside this disclosure: which acquirer ships the IDE posture category first.

The agentic security platform layer has been consolidating fast in 2026. Cisco bought Astrix for non-human identity. Palo Alto bought Portkey for AI gateway. SentinelOne and CrowdStrike are positioning Falcon and Singularity as the platforms that will absorb every adjacent posture category. None of them have shipped IDE configuration scanning. None of them have a SKU for "what's in your developer's `.claude/` folder."

Three camps can ship first. The supply-chain-security crowd — GitGuardian, Snyk, Socket, Chainguard — lives one layer over and has the developer-machine telemetry pattern down. The EDR primes — CrowdStrike, SentinelOne, Microsoft Defender for Endpoint — own the host but do not currently inspect IDE configs. The SBOM and provenance vendors just had SLSA's defensive promise weakened by this attack and need a new story. Whichever group ships first owns developer-machine posture in a way nobody owns it today.

The valuation comparable is the cloud security posture management category in 2019, before Wiz and Lacework existed. That category became roughly $50 billion of cumulative M&A over five years. The Mini Shai-Hulud disclosure is the event that creates the next version of that market. Buyers tracking the 2026 M&A landscape should expect the first dedicated IDE-posture startup raise inside six months. Microsoft is the obvious first mover — Defender already inspects VS Code extension trust at install time; adding `.claude/` to that scope is a roadmap shift, not a product build.

For public security platforms, the question is simpler. Whoever announces an IDE-config detection capability first gets credit for inventing a category. The actual code is a 200-line script. The positioning is the asset.

The reflex we have to give up

For twenty-five years we trained defenders to revoke fast. Attackers spent six months training a single piece of malware to wait for the revocation. The 90-second reflex is no longer enough. The next reflex is image first, then revoke. The reflex after that is to stop assuming our developer machines are still ours to begin with.

The most uncomfortable part of Mini Shai-Hulud is not the wipe. It is that the wipe works because the playbook is right. Rotating compromised credentials is the correct instinct. We just spent a generation building an industry around it. Mini Shai-Hulud is the first attacker to prove that a correct instinct, executed at machine speed by a defender who does not yet know the trap is wired, is itself the trap.

The worm is going to get patched. The reflex will not.