The Mini Shai-Hulud campaign poisoned TanStack's npm packages — a collection with more than 177 million weekly downloads — and distributed an infostealer that harvested developer credentials, cloud secrets and SSH keys. Mistral confirmed that attackers temporarily compromised one of its codebase management systems on 12 May and contaminated some of its SDK packages for a brief period, traced to an affected developer device.
The TeamPCP group then advertised roughly 450 internal Mistral repositories on a dark-web forum for $25,000: about 5GB of source code it said was used for training, fine-tuning, benchmarking, model delivery and inference across experiments and unreleased work. The listing was exclusive to one buyer, TeamPCP offered Mistral the chance to buy it back, and it threatened to leak everything for free if nobody paid within a week. Mistral said the affected data was not part of its core repositories and that hosted services, managed user data and research and testing environments were untouched. OpenAI confirmed the same campaign reached two of its employees who had access to a limited subset of internal source code repositories. No samples were published, and Mistral's own advisories do not confirm the scope the attackers advertised.
WHY IT MATTERS
Two things make this bigger than a routine breach. It is the first documented case of a malicious npm package shipped with valid SLSA provenance — the cryptographic certificate attesting a trustworthy build was legitimate, the build pipeline was not — which weakens provenance as a trust signal on its own. And the target was an AI lab's training, fine-tuning and evaluation code, which is the part of the company that cannot be regenerated from a repo backup. Note what the market thought it was worth: $25,000. Treat any dependency that touches your build pipeline as an attack surface on your weights, not just on your credentials.
