Model and package supply chain

The TeamPCP threat group compromised about 170 npm and PyPI packages on May 11, including the @tanstack TanStack Router ecosystem of 42 packages, the Mistral AI SDK suite on npm and PyPI, and the Guardrails AI PyPI package. The attackers exploited the pull_request_target trigger and GitHub Actions weaknesses to hijack release pipelines and obtain maintainers' short-lived OIDC tokens, then injected the Mini Shai-Hulud malware, which spread through the worm capabilities of the platform. The malware is designed to steal developer credentials, and it installs a destructive monitor that attempts to delete the home directory if a stolen GitHub token is revoked.

A new coordinated Mini Shai-Hulud supply chain attack compromised over 170 packages across NPM and PyPI, including 42 TanStack packages, 65 UiPath packages, Mistral AI's PyPI packages, the OpenSearch JavaScript client, and the Guardrails AI PyPI package. TeamPCP was blamed for the campaign, which targets developer credentials, API keys, tokens, cloud credentials, cryptocurrency wallets, and AI tool secrets, and propagates using compromised NPM and GitHub Actions tokens. In the TanStack attack, the attackers chained three weaknesses, including a pull_request_target misconfiguration and GitHub Actions cache poisoning, to extract an OIDC token and publish 84 malicious artifacts with valid SLSA provenance.

A malicious Hugging Face repository named Open-OSS/privacy-filter impersonated OpenAI's Privacy Filter release, copying its model card and including a malicious loader.py file. The repository reached the #1 trending position with approximately 244K downloads before removal, and HiddenLayer reported that its loader delivered a credential-stealing infostealer to Windows hosts.

Pillar Security reports a critical flaw in Gemini CLI, the open source AI agent, rated CVSS 10/10 but lacking a CVE identifier. In --yolo mode, Gemini CLI ignored tool allowlists, so an attacker could hide malicious prompts in a public GitHub issue and have the agent triage it run commands, extract build-environment secrets and send them to an attacker-controlled server. Pillar says at least eight other Google repositories used the same vulnerable workflow template.

ReversingLabs researchers tracked PromptMink, a supply-chain campaign attributed to North Korea's Famous Chollima that uses "LLM Optimization (LLMO) abuse and knowledge injection" to make malicious packages more likely to be chosen by AI coding agents. The campaign began last September with the bait package @solana-launchpad/sdk and the malicious dependency @hash-validator/v2, which contained a JavaScript infostealer. Attackers later rotated in additional packages and shifted to compiled payloads, including Single Executable Applications and Rust-based NAPI-RS Node.js add-ons.

Novee Security researchers found a critical remote code execution flaw in Gemini CLI, an open source AI agent for terminal access to Gemini, which Google patched in Gemini CLI and the 'run-gemini-cli' GitHub Action. Gemini CLI automatically trusted the current workspace folder and loaded any agent configuration in it without review, sandboxing or approval, so an attacker who planted a malicious configuration could run arbitrary commands on the host before sandbox initialization. The researchers said this could expose secrets, credentials and source code and enable token theft, lateral movement and supply chain attacks in CI/CD pipelines.

ReversingLabs reported a North Korea-linked campaign it calls PromptMink, attributed to Famous Chollima (aka Shifty Corsair), in which malicious npm packages posing as crypto utility SDKs steal sensitive secrets. The packages were introduced via a February 28 commit to an autonomous trading agent that was co-authored by Anthropic's Claude Opus, and they give attackers access to users' crypto wallets and funds. The attack uses a phased design in which first-layer packages import second-layer malicious packages that are replaced when removed.

Researchers warn that a flaw in Anthropic's Model Context Protocol lets unsanitized commands execute silently. The flaw could enable full system compromise across widely used AI environments.