TeamPCP Shai-Hulud: GitHub, OpenAI, Mistral Breached via Supply Chain Escalation

Rudra Verma, Senior Security Architect & Researcher · 2026-05-31

Between 2026-05-18 and 2026-05-24, the threat actor tracked as TeamPCP executed the most damaging week of their Shai-Hulud supply chain campaign to date. Three simultaneous attack vectors — a trojanized VS Code extension with a verified-publisher badge, a poisoned Microsoft Azure Python SDK on PyPI carrying a Linux disk wiper, and a 639-package npm flood across the @antv ecosystem — resulted in confirmed intrusions at GitHub, OpenAI, Grafana Labs, and Mistral AI.

GitHub CISO Alexis Wales publicly confirmed on 2026-05-21 that approximately 3,800 internal repositories were exfiltrated. The root cause traced back to a developer endpoint that auto-updated the malicious Nx Console extension during an 18-minute window on May 18. OIDC credentials harvested in TeamPCP's earlier TanStack wave (May 11, tracked as CVE-2026-45321 per SANS ISC) were used to publish the trojanized extension through the legitimate nrwl.angular-console verified-publisher account.

As of May 25, the Shai-Hulud framework source code had been published to GitHub and copycat forks were already active, materially complicating attribution going forward. Defenders should rotate credentials immediately if any of the affected packages touched their environments.

◈ Table of Contents

01 Threat Actor Profile 02 Nx Console Extension Attack 03 Microsoft Azure SDK Poisoned 04 The @antv npm Wave 05 TTPs & Kill Chain 06 Indicators of Compromise 07 Detection & Hunt Queries 08 Immediate Defense Actions 09 MITRE ATT&CK Mapping 10 Sources & References

🎭

Phase 01 — Threat Actor Profile

TEAMPCP

TeamPCP — Attribution & Campaign History

Actor Profile

TeamPCP is a financially motivated threat actor specializing in software supply chain attacks through package registry poisoning. Their Shai-Hulud campaign has operated across npm, PyPI, and VS Code Marketplace since at least late 2025. Attribution is technical (framework artifacts, string lineage, C2 infrastructure) rather than nation-state; no government has formally attributed the group.

Attribute	Detail
Actor Name	TeamPCP (self-designated)
Campaign Name	Shai-Hulud / Mini Shai-Hulud
First Observed	Late 2025 (npm ecosystem)
Motivation	Credential theft, cloud infrastructure access, potential destructive capability (disk wiper)
Target Ecosystems	npm, PyPI, VS Code Marketplace
Known Aliases	UNC6780 (Mandiant, unconfirmed)
Monetization Arms	Vect ransomware affiliate, CipherForce (both currently inactive)
Tracking CVE	CVE-2026-45321 (OIDC credential abuse, TanStack wave)

🔌

Phase 02 — The Nx Console VS Code Extension Attack

2026-05-18

Trojanized Extension — 18 Minutes on the Marketplace

Initial Breach

On 2026-05-18, TeamPCP published a malicious build of the Nx Console VS Code extension (version 18.95.0, publisher nrwl.angular-console) to the Visual Studio Marketplace. The publisher account carried the Marketplace's verified-publisher badge — because it was legitimate. The malicious build was live for approximately 18 minutes before being pulled. Any developer endpoint with auto-update enabled that was running VS Code during that window is considered exposed.

Attack Sequence

1
Credential theft (May 11): TeamPCP harvested OIDC credentials from the TanStack supply chain wave via CVE-2026-45321. These credentials included publish rights to the nrwl.angular-console Marketplace account.
2
Malicious publish (May 18, ~18 minutes): v18.95.0 published to VS Code Marketplace using stolen credentials. Extension carried verified-publisher badge — a legitimate trust signal attached to a poisoned build.
3
Auto-update compromise: At least one GitHub employee's endpoint auto-updated during the window. The extension executed on load, exfiltrated developer secrets from the local environment, and used those to move laterally through GitHub's internal CI/CD.
4
GitHub breach confirmed (May 21): GitHub CISO Alexis Wales publicly named Nx Console v18.95.0 as the root cause. Approximately 3,800 GitHub-internal repositories were exfiltrated. Downstream victims with developers who had auto-update enabled: OpenAI, Grafana Labs, Mistral AI.

The VS Code Marketplace verified-publisher badge did NOT protect against this attack. The badge confirms that the publisher account is legitimate — not that any specific version published is legitimate. Do not use the badge as an install-time safety signal.

🐍

Phase 03 — Microsoft Azure Python SDK Poisoned on PyPI

2026-05-19

durabletask 1.4.1 – 1.4.3 — Disk Wiper Payload

PyPI Compromise

On 2026-05-19, TeamPCP published three trojanized versions of Microsoft's official Azure Durable Functions Python client (durabletask) to PyPI. The package has approximately 417,000 monthly downloads. The malicious dropper is injected directly into the package's Python source files — meaning importing the SDK is sufficient to trigger execution. Independent reporting characterizes the second-stage payload as carrying a Linux disk wiper, materially extending the campaign's destructive capability.

Attribute	Detail
Package Name	durabletask (official Microsoft Azure Durable Functions SDK)
Malicious Versions	1.4.1, 1.4.2, 1.4.3
Monthly Downloads	~417,000
Trigger	Package import (no explicit execution required)
Second-Stage Payload	Credential stealer + Linux disk wiper
Credential Targets	AWS, Azure, GCP, HashiCorp Vault, 1Password, Bitwarden
Propagation	AWS SSM (inside EC2), kubectl exec (inside Kubernetes)
Window	Published 2026-05-19, yanked within ~35 minutes

Any environment that installed durabletask versions 1.4.1, 1.4.2, or 1.4.3 on 2026-05-19 should be treated as fully compromised — including ephemeral CI runners. The import alone is the trigger. Rotate all credentials from affected hosts immediately.

The disk wiper marks the first confirmed destructive capability in this campaign. Prior waves focused on credential theft and propagation. Incident responders should verify data integrity on any host that executed these versions before proceeding with credential rotation alone.

📦

Phase 04 — The @antv npm Wave: 639 Malicious Versions

2026-05-19

@antv Ecosystem — Largest Single-Hour Burst by Package Count

npm Compromise

On the same day as the durabletask poisoning, a compromised @antv maintainer account ("atool") was used to publish 639 malicious versions across 323 packages in the @antv npm ecosystem. This is the largest single-hour Shai-Hulud burst yet recorded. The ~499 KB obfuscated JavaScript payload executes during npm install and harvests over 20 credential classes.

Affected @antv packages weekly download volume

NAMED HIGH-VOLUME PACKAGES IN THE @ANTV WAVE — SOURCE: STEPSECURITY / SNYK / SOCKET (2026-05-19)

A previously unreported primitive appeared in this wave: 42 of the 639 malicious packages displayed forged Sigstore verification badges in the npm UI. Combined with the prior wave that shipped valid SLSA Build Level 3 provenance from hijacked release pipelines, provenance is now being attacked from two directions simultaneously — real attestations from compromised pipelines, and fake attestations in the registry UI. Visual trust indicators are no longer reliable.

Credentials Harvested by the Payload

GitHub tokens and npm granular access tokens (with write permissions and 2FA bypass for ~61,274 tokens invalidated by GitHub cleanup)
AWS access keys, GCP service account tokens, Azure credentials
HashiCorp Vault secrets, Stripe API keys
SSH private keys, Kubernetes service account tokens
Local password vaults from 1Password and Bitwarden

⚔️

Phase 05 — TTPs & Kill Chain

Attack Flow

TEAMPCP ATTACK FLOW — WEEK OF 2026-05-18

Novel TTPs Introduced in This Wave

First-of-Kind

This wave introduced techniques not previously observed in the Shai-Hulud campaign and some that are novel in the broader supply chain threat landscape.

🏷️

Forged Sigstore Badges

42 of the 323 malicious @antv packages displayed fake Sigstore verification badges in the npm UI — the first observed instance of forged registry trust indicators in this campaign.

✅

Verified-Publisher Account Hijack

The Nx Console extension carried Visual Studio Marketplace's verified-publisher badge because the underlying publisher account was legitimate. A stolen credential-to-publish is indistinguishable from a legitimate publish from the registry's perspective.

💾

Linux Disk Wiper

The durabletask second-stage payload reportedly carries a disk wiper — the campaign's first confirmed destructive capability, extending beyond credential theft and cloud lateral movement.

🤖

AI Agent Persistence

Persistence via ~/.claude/settings.json and .vscode/tasks.json specifically targets AI coding agent environments — a persistence vector designed for modern developer workflows.

📖

Open-Sourced Framework

On 2026-05-22, the Shai-Hulud framework source was published to GitHub. Copycat forks appeared within hours. Detection signatures built on framework artifacts will now fire on unrelated operators.

🔗

Multi-Stage Chain

First publicly confirmed multi-stage operation: TanStack OIDC credentials (May 11) reused to publish Nx Console trojan (May 18) that breached GitHub. Loot from one wave funds the next.

🔍

Phase 06 — Indicators of Compromise

IOC Table

Package IOCs — VS Code, PyPI, npm

Packages

Registry	Package / Publisher	Malicious Version(s)	Date
VS Code Marketplace	Nx Console (nrwl.angular-console)	18.95.0	2026-05-18 (~18 min window)
PyPI	durabletask (Microsoft official)	1.4.1, 1.4.2, 1.4.3	2026-05-19 (~35 min window)
npm	@antv/echarts-for-react	Multiple (wave of 639)	2026-05-19
npm	@antv/size-sensor	Multiple	2026-05-19
npm	@antv/timeago.js	Multiple	2026-05-19
npm	@antv/* (323 packages total)	639 versions across ecosystem	2026-05-19

Persistence Paths & C2 Infrastructure

Host/Network IOCs

IOC Type	Indicator	Purpose
File Path	~/.claude/settings.json	Persistence in AI coding agent environments
File Path	.vscode/tasks.json	VS Code task-based persistence
C2 Domain	filev2[.]getsession[.]org	Session Messenger exfiltration channel
C2 Domain	seed1[.]getsession[.]org	Session Messenger exfiltration channel
String Artifact	PBKDF2 salt strings (campaign fingerprint)	Present in all Shai-Hulud wave payloads
String Artifact	"niagA oG eW ereH :duluH-iahS" (reversed)	Framework identifier in GitHub repo naming
String Artifact	"Love - TeamPCP" in README	Framework source repository identifier

🛡️

Phase 07 — Detection & Hunt Queries

Detection Logic

Persistence Detection — AI Agent & VS Code Paths

Endpoint

Linux / macOS — Hunt for Shai-Hulud persistence writes

# Hunt for suspicious writes to AI coding agent persistence paths # Run on developer endpoints and CI/CD runner hosts $ find / -name "settings.json" -path "*/.claude/*" -newer /tmp/baseline_date 2>/dev/null $ find / -name "tasks.json" -path "*/.vscode/*" -newer /tmp/baseline_date 2>/dev/null # Check for anomalous outbound to Session Messenger C2 $ grep -r "getsession\.org" ~/.claude/ .vscode/ ~/.npm/ 2>/dev/null # Scan node_modules for PBKDF2 salt string (campaign fingerprint) $ grep -r "PBKDF2" node_modules/ --include="*.js" -l 2>/dev/null | head -30

KQL — Sentinel / Defender — Detect malicious package execution side effects

// Detect writes to known Shai-Hulud persistence paths DeviceFileEvents | where TimeGenerated > ago(7d) | where FolderPath has ".claude" and FileName == "settings.json" or (FolderPath has ".vscode" and FileName == "tasks.json") | where InitiatingProcessFileName in~ ("node", "npm", "npx", "bun") | project TimeGenerated, DeviceName, FolderPath, FileName, InitiatingProcessCommandLine | order by TimeGenerated desc // Detect DNS queries to Session Messenger C2 infrastructure DnsEvents | where TimeGenerated > ago(7d) | where Name has "getsession.org" | summarize count() by Computer, Name, bin(TimeGenerated, 1h)

npm Audit — Identify affected @antv packages in lockfile

# Check if any @antv packages are pinned to wave-era versions # Affected window: 2026-05-19 (verify against your lockfile timestamps) $ npm audit --audit-level=high 2>/dev/null | grep -i "@antv" $ cat package-lock.json | python3 -c " import json,sys lock=json.load(sys.stdin) pkgs=lock.get('packages',{}) for k,v in pkgs.items(): if '@antv' in k: print(k, v.get('version','?'), v.get('resolved','')) "

Do not rely on Sigstore verification badges or SLSA provenance attestations as install-time safety signals. This campaign demonstrated both can be forged or produced by hijacked legitimate pipelines. Pin exact versions and verify lockfile hashes against a known-good baseline from before 2026-05-18.

🔒

Phase 08 — Immediate Defense Actions

Remediation

Priority Remediation Steps

Urgent

1
Nx Console v18.95.0: Inventory all developer endpoints with VS Code auto-update enabled. Any endpoint running VS Code during the ~18-minute window on 2026-05-18 should be treated as exposed. Rotate all credentials stored on or accessible from those endpoints.
2
durabletask PyPI versions 1.4.1 – 1.4.3: Treat any environment that imported these versions on 2026-05-19 as fully compromised — including ephemeral CI runners. Check for disk-wipe indicators before proceeding with credential rotation alone.
3
@antv npm packages: Inventory all @antv/* installations. Rotate all credentials from affected hosts: GitHub PATs, npm tokens, AWS/GCP/Azure credentials, HashiCorp Vault secrets, 1Password and Bitwarden vaults.
4
Audit persistence paths: Check all developer endpoints for ~/.claude/settings.json and .vscode/tasks.json modifications from the 2026-05-18 to 2026-05-24 window.
5
Kubernetes / AWS SSM: Audit recent kubectl exec and AWS SSM session history for anomalous activity from compute that ran any of the affected packages.
6
Token hygiene: GitHub invalidated ~61,274 npm granular access tokens with write permissions and 2FA bypass. Verify your tokens are not among the invalidated set; reissue if uncertain.
7
Copycat awareness: The open-sourced framework means detection signatures built on TeamPCP-specific artifacts (PBKDF2 salts, dead-drop strings) will now also fire on copycat operators. Supplement with behavioral indicators (Session exfil, .claude/.vscode persistence) that are more durable.

🗺️

Phase 09 — MITRE ATT&CK Mapping

ATT&CK Framework

Tactic	Technique ID	Technique	Evidence
Initial Access	T1195.002	Supply Chain Compromise: Software Supply Chain	npm, PyPI, VS Code Marketplace trojanization
Execution	T1059.007	Command and Scripting Interpreter: JavaScript	npm install trigger, obfuscated JS payload (~499KB)
Execution	T1059.006	Command and Scripting Interpreter: Python	durabletask import-time execution
Persistence	T1554	Compromise Host Software Binary	Injected dropper into package source files
Persistence	T1053.003	Scheduled Task/Job: Cron / Task	Persistence via .vscode/tasks.json
Credential Access	T1528	Steal Application Access Token	GitHub/npm/AWS/GCP/Azure/Vault/Stripe tokens
Credential Access	T1552.001	Unsecured Credentials: Credentials in Files	1Password / Bitwarden local vault extraction
Lateral Movement	T1021.001	Remote Services: SSH	SSH key theft enabling cloud lateral movement
Collection	T1119	Automated Collection	20+ credential class harvesting at npm install time
Exfiltration	T1041	Exfiltration Over C2 Channel	Session Messenger C2 (filev2[.]getsession[.]org)
Impact	T1485	Data Destruction	Linux disk wiper in durabletask second stage
Impact	T1496	Resource Hijacking	Cloud infrastructure access for further propagation

📚

Phase 10 — Sources & References

Attribution

SANS ISC Diary #33016 — TeamPCP Supply Chain Campaign: Activity Through 2026-05-24 (Kenneth Hartman) StepSecurity — Shai-Hulud: Mass npm Supply Chain Attack Hits @antv Ecosystem Snyk — Mini Shai-Hulud: @antv npm Supply Chain Attack Socket — @antv Packages Compromised Wiz — durabletask TeampCP Supply Chain Attack Aikido Security — durabletask Package Compromised: Mini Shai-Hulud Datadog Security Labs — Shai-Hulud Open-Source Framework Static Analysis Help Net Security — GitHub Breached: TeamPCP Root Cause (Nx Console) Endor Labs — Trojanized Microsoft SDK durabletask 1.4.1-1.4.3

🔍 Check Your Environment for Shai-Hulud IOCs

Use the CyberHawk IOC Scanner to check domains (getsession[.]org infrastructure), file hashes, and package indicators from this campaign against your environment telemetry. The scanner supports bulk lookups and integrates with common SIEM formats.

→ cyberhawkthreatintel.com/ioc-scanner

◈ Stay Connected

Follow CyberHawk Threat Intel for threat intelligence, deployment guides and hands-on SOC tooling content.

🌐 Website ▶️ YouTube ▶️ YouTube (2) 𝕏 Twitter / X ♪ TikTok ✈️ Telegram

🔍 IOC Scanner 🛠️ Live Tools 📚 Courses 🚨 Threat Intel 📝 Blog 📋 SOPs

"They can't exploit you if you are the Exploit."