Financially Motivated Threat Actor TeamPCP Compromises TanStack Library in 'Mini Shai-Hulud' Supply Chain Attack
TeamPCP Threat Actor Breaches TanStack in 'Mini Shai-Hulud' Supply Chain Campaign
Full Report
Executive Summary
A financially motivated threat cluster known as TeamPCP has been attributed to a widespread supply chain campaign dubbed "Mini Shai-Hulud." This campaign recently achieved a significant victory by compromising the popular open-source library TanStack, a suite of widely used tools for building web applications. The attack, which also impacted the npm and PyPI package ecosystems, relies on typosquatting and dependency confusion to trick developers into downloading malicious packages. Once installed, these packages execute a payload designed to steal credentials and other sensitive information from the developer's environment. The breach of a foundational library like TanStack poses a severe risk to the software supply chain, potentially affecting thousands of downstream applications and organizations.
Threat Overview
TeamPCP is a threat group focused on compromising developer environments to steal valuable secrets, such as API keys, private code, and cryptocurrency wallets. Their "Mini Shai-Hulud" campaign employs several common supply chain attack techniques.
- Attack Vector: The primary vector is publishing malicious packages to public repositories like npm and PyPI. These packages often use names similar to legitimate ones (typosquatting) or exploit how package managers resolve dependencies to get their malicious code installed (dependency confusion).
- Malicious Action: The malicious packages contain installation scripts (e.g.,
postinstallscripts inpackage.json) that execute automatically upon download. This script typically downloads and runs a second-stage payload, which is the credential stealer. - Targeting: The compromise of TanStack is particularly impactful. TanStack provides popular libraries like TanStack Query (formerly React Query) and TanStack Table, which are used by countless developers and companies. By compromising this upstream project, TeamPCP gains a powerful distribution channel for its malware.
Technical Analysis
The attack chain is typical of modern package manager-based supply chain attacks:
- Package Publication: TeamPCP publishes a malicious package to npm or PyPI. The package might be a direct compromise of a legitimate package (if they steal maintainer credentials) or a typosquatted version.
- Installation: A developer or a CI/CD system installs the malicious package, believing it to be legitimate.
- Automated Execution: The package manager automatically runs a
postinstallscript defined in the malicious package's configuration file. - Payload Delivery: The script contacts an attacker-controlled server to download the main credential-stealing payload. This two-stage approach helps evade static analysis of the package itself.
- Credential Theft & Exfiltration: The payload scans the compromised system for environment variables, configuration files (
.env,.aws/credentials), SSH keys, and browser data, then exfiltrates the findings to the attacker's C2 server.
MITRE ATT&CK Techniques
T1195.001 - Compromise Software Dependencies and Development Tools: The attack centers on poisoning packages in public software repositories.T1078 - Valid Accounts: To compromise a major package like TanStack, the attackers likely needed to compromise a legitimate maintainer's account.T1059 - Command and Scripting Interpreter: The use ofpostinstallscripts to execute malicious commands.T1555 - Credentials from Password Stores: The payload is designed to steal credentials from various sources on the developer's machine.T1041 - Exfiltration Over C2 Channel: Stolen data is sent back to the attacker.
Impact Assessment
The compromise of a foundational framework like TanStack has a cascading effect across the software industry.
- Direct Impact: The immediate victims are the developers and organizations that directly installed the compromised version of the package. Their development environments, CI/CD pipelines, and any secrets accessible from them are considered compromised.
- Downstream Impact: Any application built using the compromised TanStack library is now a potential risk to its own users. While the primary goal of the malware is to steal developer credentials, it could also be modified to inject backdoors into the final application.
- Ecosystem Erosion: Each successful attack of this nature further erodes the trust developers place in the open-source ecosystem. It forces developers to be more vigilant but also increases friction in the development process, as dependencies must be more carefully vetted.
IOCs — Directly from Articles
No specific package names, versions, or C2 domains were mentioned in the source articles.
Detection & Response
- Detection: Use dependency scanning tools (e.g.,
npm audit, Snyk, Dependabot) to check for known malicious packages. Monitor network logs from developer machines and build servers for suspicious outbound connections, especially from package manager processes. Analyzepackage-lock.jsonoryarn.lockfiles to see exactly which package versions are being used and from where they were resolved. - Response: If a malicious package is discovered:
- Immediately remove the dependency from the project and delete it from local caches (
node_modules). - Isolate the affected machines.
- Assume all secrets on the machine have been compromised and begin a full credential rotation.
- Investigate logs to determine what commands the malicious
postinstallscript executed.
- Immediately remove the dependency from the project and delete it from local caches (
Mitigation
- Dependency Vetting: Do not blindly trust packages. Before adding a new dependency, check its reputation, download statistics, and the activity of its maintainers. Be wary of typosquatted package names.
- Lockfiles: Always use and commit lockfiles (
package-lock.json,yarn.lock,poetry.lock). This ensures that builds are reproducible and that only specific, vetted versions of dependencies are installed, preventing a malicious update from being pulled in automatically. - Disable Scripts: Consider running package manager commands with flags that disable automatic script execution (e.g.,
npm install --ignore-scripts) in environments where it's not strictly necessary. This provides a crucial layer of protection against maliciouspostinstallhooks. - Secure Environments: Run builds in ephemeral, isolated containers with no access to the broader network or persistent secrets. Use least-privilege principles for all CI/CD jobs.
Timeline of Events
MITRE ATT&CK Mitigations
Execution Prevention
Prevent the automatic execution of installation scripts from package managers (e.g., using `--ignore-scripts`).
Use automated dependency scanning tools to audit projects for malicious or vulnerable packages.
Filter Network Traffic
Apply strict egress filtering on build servers to prevent malicious scripts from connecting to attacker C2 servers.
Run build processes in isolated, ephemeral environments to limit the potential impact of a compromised dependency.
D3FEND Defensive Countermeasures
While traditionally for binaries, the principle of Executable Allowlisting can be adapted to CI/CD pipelines to defend against attacks like the one on TanStack. Instead of allowing npm or pip to execute any arbitrary postinstall script, the build environment should be hardened to prevent it. A practical implementation is to run package manager commands with flags that disable script execution by default (e.g., npm install --ignore-scripts). If a specific package legitimately requires a post-install script, it can be explicitly allowed after a thorough security review. This 'default-deny' posture for script execution directly blocks the primary attack vector used by TeamPCP, preventing the malicious payload from ever running, even if a compromised package is downloaded.
Dynamic Analysis in a sandbox is a powerful technique for vetting new or updated dependencies before they are introduced into a production build environment. Before a developer commits an update to a dependency like TanStack, the new version should be automatically installed in an isolated, instrumented sandbox. This sandbox would monitor for suspicious activities during installation, such as: 1) Network connections to unknown or non-repository domains. 2) Filesystem access outside the package's directory. 3) Execution of unexpected processes. If the sandbox detects the malicious postinstall script attempting to contact a C2 server, it would flag the package as malicious and block the dependency update. This automated vetting process acts as a crucial quality gate, preventing poisoned packages from entering the software supply chain.
System File Analysis, in the form of dependency scanning, is a fundamental defense. Organizations must integrate automated tools like Snyk, Dependabot, or npm audit directly into their CI/CD pipelines. These tools maintain databases of known malicious packages and vulnerabilities. When a developer attempts to add or update a dependency, the scanner checks the package name and version against this database. In the case of the TanStack compromise, once the malicious version was identified and added to these databases, any subsequent build attempting to use it would fail with a security warning. This provides a rapid, ecosystem-wide response to known threats. It's a critical, albeit reactive, control that helps contain the spread of a publicly disclosed supply chain attack.
Timeline of Events
A coordinated supply chain attack linked to the 'Mini Shai-Hulud' campaign compromises the npm and PyPI ecosystems, including the TanStack library.
The attack campaign is publicly attributed to the threat group TeamPCP.
Sources & References
Article Author
Jason Gomes
• Cybersecurity PractitionerCybersecurity professional with over 10 years of specialized experience in security operations, threat intelligence, incident response, and security automation. Expertise spans SOAR/XSOAR orchestration, threat intelligence platforms, SIEM/UEBA analytics, and building cyber fusion centers. Background includes technical enablement, solution architecture for enterprise and government clients, and implementing security automation workflows across IR, TIP, and SOC use cases.
Tags
📢 Share This Article
Help others stay informed about cybersecurity threats
🎯 MITRE ATT&CK Mapped
Every tactic, technique, and sub-technique used in this threat has been identified and mapped to the MITRE ATT&CK framework for consistent, actionable threat language.
🧠 Enriched & Analyzed
Observables and indicators of compromise (IOCs) have been extracted and cataloged. Risk has been assessed and correlated with known threat actors and historical campaigns.
🛡️ Actionable Guidance
Detection rules, incident response steps, and D3FEND-aligned mitigation strategies are included so your team can act on this intelligence immediately.
🔗 STIX Visualizer
Structured threat data is packaged as a STIX 2.1 bundle and can be visualized as an interactive graph — relationships between actors, malware, techniques, and indicators.
⚡ Sigma Generator
Sigma detection rules are derived from the threat techniques in this article and can be converted for deployment across any major SIEM or EDR platform.