By ByteBot
A supply chain worm called Mini Shai-Hulud — deployed by the threat group TeamPCP — became the first autonomous worm to propagate across six open source ecosystems without a human operator after initial launch. It compromised Trivy, Checkmarx KICS, Bitwarden CLI, LiteLLM, and more than 160 other packages with a combined 518 million historical downloads. A new wave, ChainDrop, is active right now targeting keyv and cacheable. If you run npm or PyPI packages in CI/CD or on a developer machine, this is not a news story to file away.
How the Worm Moves
The mechanism is straightforward — and that’s what makes it dangerous. TeamPCP (tracked as UNC6780 by Google’s Threat Intelligence Group) gains an initial foothold through a stolen publish token — typically harvested from a malicious VS Code extension or a compromised GitHub Action in CI/CD. From there the worm deploys a postinstall hook into the poisoned package version. Every developer who installs it runs the hook automatically.
That hook does two things: it exfiltrates every credential it can find on the machine — npm tokens, PyPI tokens, GitHub personal access tokens, SSH keys, AWS IAM credentials, GCP service accounts, Azure tokens, and HashiCorp Vault tokens — and it uses those stolen publish credentials to push poisoned versions of other packages the victim maintains. Each compromised developer becomes a new distribution node. No human intervention required after that.
Between March and May 2026, TeamPCP ran six distinct campaign waves this way, compromising more than 170 packages across 19 namespaces and publishing over 400 malicious versions. The Hacker News covered the initial worm in April; new waves have continued since.
They Targeted the Tools That Guard You
The target selection was not random. TeamPCP went straight for the security toolchain: the scanners, static analyzers, and password managers that already hold elevated access on every developer machine. These tools run with higher privileges and are rarely scrutinized the way application dependencies are.
The most striking example is Bitwarden CLI. TeamPCP did not break into Bitwarden’s codebase. Instead, they compromised Checkmarx KICS, which Bitwarden’s CI/CD pipeline used as a GitHub Action. The poisoned KICS image injected malicious code into Bitwarden’s build step, publishing @bitwarden/cli@2026.4.0 to npm with a credential-stealing payload for roughly 90 minutes. Bitwarden’s vault was never touched — but every developer who ran a fresh install of the CLI during that window potentially had credentials harvested.
This is the cascade attack: you don’t need to compromise the target directly if you can compromise something the target trusts.
Why “Signed” No Longer Means “Safe”
Here’s the finding that should recalibrate your threat model. The compromised TanStack packages in Mini Shai-Hulud carried valid SLSA Build Level 3 provenance attestations from the Sigstore ecosystem. These were not forged. Sigstore correctly attested that the packages were built by GitHub Actions running under the TanStack repository’s identity.
What Sigstore cannot attest is the condition of that build environment. The worm poisoned a GitHub Actions CI cache through a fork-pull-request misconfiguration, then waited for a legitimate maintainer to merge. When the release pipeline ran, it ran honestly — and it ran compromised code. The attestation was accurate; the package was malicious. As CSA researchers noted: “SLSA answers ‘was this built by the right environment?’ — not ‘was that environment clean?’”
Provenance attestations remain valuable. Treating them as a security guarantee is exactly the assumption TeamPCP weaponized.
What to Check Right Now
If your development environment or CI/CD pipeline installed any of the affected packages — Trivy, Checkmarx KICS, LiteLLM, TanStack, Bitwarden CLI, keyv, or cacheable — rotate credentials immediately. Tenable’s FAQ has the full scope list.
- npm publish tokens
- PyPI API tokens
- GitHub personal access tokens and repository secrets
- SSH private keys from
~/.ssh - AWS access keys (
~/.aws/credentials), GCP service account credentials, Azure CLI tokens - HashiCorp Vault tokens
- Any key stored in
.envfiles in project directories
To detect active infections: look for unexpected .pth files in Python site-packages/ directories — a file like litellm_init.pth that you didn’t place there is a strong indicator of CanisterSprawl. In your GitHub repositories, check .github/workflows/ for any runtime-update.yml files you didn’t create. On npm, audit every package you publish for releases you didn’t initiate, particularly anything dated on or after September 23, 2026.
The Trend That Won’t Slow Down
TeamPCP is not a one-off. Autonomous AI agents as offensive tools have lowered the cost of running multi-ecosystem supply chain campaigns to something a small criminal group can operate at scale. A separate campaign in September 2026 used autonomous AI agents to compromise thousands of credentials in under six hours across 395 organizations in 48 countries. The FBI has formally warned developers. Supply chain attacks are up over 400% this year.
The lesson is not that npm or PyPI is broken. It’s that the developer toolchain — the scanners, formatters, password managers, and build tools you trust implicitly — is now a high-value target with a large attack surface. Scoped per-package publish tokens, locked GitHub Actions workflow permissions, outbound network restrictions on CI/CD runners, and runtime behavior monitoring are not nice-to-haves. They’re the baseline TeamPCP just proved is missing.
