Mini Shai-Hulud
MITRE ATT&CK: S9043 View on attack.mitre.org
Aliases: Mini Shai-Hulud
- Profile updated
- 2026-08-15 03:00:04
Context
Mini Shai-Hulud is a credential stealer and self-replicating supply chain worm, derived from Shai-Hulud, that has been used by TeamPCP to target Continuous Integration and Continuous Delivery/Deployment (CI/CD) workflows since at least 2026. Mini Shai-Hulud can compromise credentials across multiple cloud, container, and AI configuration file paths and can use stolen npm and GitHub OIDC tokens to spread to other packages maintained by the compromised user. Mini Shai-Hulud also has a targeted wiper component and has used multiple C2 and data exfiltration mechanisms.(Citation: Wiz Mini Shai-Hulud MAY 2026)(Citation: Trend Micro TeamPCP MAY 2026)(Citation: Hunt.io TeamPCP Toolkit MAY 2026)(Citation: Phoenix TeamPCP 20 MAY 2026)(Citation: Flashpoint Mini Shai-Hulud MAY 2026)(Citation: FBI TeamPCP JUL 2026)
Used by threat actors
- TeamPCP (threat-actor)
Reports & references
- ic3.gov — 260702 (report)
- Trend Micro — Analyzing Teampcp Supply Chain Attacks (report)
- MITRE ATT&CK — S9043 (report)
- flashpoint.io — Mini Shai Hulud Worm New Era Ci Cd Exploitation (report)
- hunt.io — Teampcp Python Toolkit Firescale Github C2 Takedown (report)
- phoenix.security — Teampcp Github Breach Durabletask Pypi Supply Chain Wave Four 2026 (report)
- wiz.io — Mini Shai Hulud Strikes Again Tanstack More Npm Packages Compromised (report)