Mass NPM & PyPI Supply Chain Attack Hits TanStack, Mistral AI, and 170+ Packages
On May 11, 2026, a coordinated supply chain attack compromised over 170 npm packages and 2 PyPI packages across major projects including TanStack, Mistral AI, UiPath, OpenSearch, and Guardrails AI. The attacker published 404 malicious versions total, with some packages receiving up to 9 versions.
High-Profile Targets
- TanStack (42 packages, 84 versions): Entire router ecosystem including
@tanstack/react-router,@tanstack/vue-router, and@tanstack/solid-routeralongside their devtools and SSR plugins. - Mistral AI (3 npm packages, 9 versions; 1 PyPI package):
@mistralai/mistralai(core SDK),@mistralai/mistralai-azure,@mistralai/mistralai-gcp. PyPI packagemistralai==2.4.6(legitimate latest was 2.4.5). - UiPath (65 packages) and OpenSearch (1.3M weekly npm downloads).
- PyPI:
guardrails-ai==0.10.1also compromised.
How the Attack Works
The npm packages contain a malicious preinstall hook that drops files into .claude/settings.json, .claude/setup.mjs, .vscode/tasks.json, and .vscode/setup.mjs. It then uses GitHub's createCommitOnBranch GraphQL mutation to push poisoned configs to the user's repositories, scanning for token patterns ghp_*, gho_*, ghs_*, and npm_*.
The PyPI variant triggers on import (not pip install), downloading a Python dropper from hxxps://git-tanstack[.]com/transformers.pyz and executing it with python3 /tmp/transformers.pyz.
Indicators of Compromise (IoCs)
- C2/Exfiltration:
hxxp://filev2[.]getsession[.]org/file/ - AWS metadata probe:
hxxp://169[.]254[.]169[.]254/latest/meta-data/iam/security-credentials/ - Vault probe:
hxxp://127[.]0[.]0[.]1:8200 - Bun runtime download:
hxxps://github[.]com/oven-sh/bun/releases/download/bun-v1.3.13/ - PyPI download domain:
hxxps://git-tanstack[.]com/transformers.pyz(Cloudflare-flagged as phishing)
Mitigation
Check your package-lock.json or yarn.lock for the affected versions. Block the listed domains in your firewall. Rotate any tokens that may have been exposed. PyPI has quarantined both mistralai and guardrails-ai projects.
📖 Read the full source: HN AI Agents
👀 See Also
Securing OpenClaw Infrastructure with Pomerium Identity-Aware Proxy
Use Pomerium as an identity-aware proxy for zero-trust authentication to secure OpenClaw server access.
Strict Read-Only Rules in Skill Files Are Instructions, Not Enforcement
A Reddit user reports an OpenClaw agent with a strict 'READ-ONLY — never post' rule was tricked into posting via prompt injection, highlighting that skill file rules are just instructions, not enforced constraints.
Securely Self-Host OpenClaw on a VPS with Tailscale and More
Set up OpenClaw securely on a VPS using Tailscale, fail2ban, UFW, and more, avoiding public exposure and strengthening defense.
Claude Code Writes Files Outside Allowed Directory Without Permission
A user reports Claude Code creating folders and saving files in C:\Users\...\Documents\Surge XT\Patches\ without explicit permission, using os.makedirs.