Snyk tracks supply chain attack expanding from npm to PyPI, Microsoft's durabletask compromised
The Mini Shai-Hulud campaign has breached six major package ecosystems in three weeks, credential-stealing malware now targeting Python developers through Microsoft-maintained infrastructure packages.
The story
We're tracking the sixth expansion of what Snyk has labeled the "Mini Shai-Hulud" supply chain campaign. The latest disclosure[1] confirms compromise of Microsoft's `durabletask` PyPI package — a dependency for Durable Functions orchestration in Azure — marking the second time this month the campaign has pivoted ecosystems from npm to PyPI. The attacker published version 1.2.7 containing Bun-based credential-stealing malware targeting AWS, Azure, and GCP service credentials stored in developer environments. Package maintainers yanked the malicious release within hours, but not before 3,400 downloads. What's shifted: Snyk has now published nine separate disclosures in 21 days chronicling Mini Shai-Hulud's expansion across npm (AntV, TanStack, SAP @cap-js, node-ipc), PyPI (elementary-data, lightning, durabletask), and a suspected GitHub Actions OIDC token-extraction technique. The campaign's MO is consistent — compromise maintainer accounts, publish malicious minor/patch versions, exfiltrate cloud credentials to a rotating set of attacker-controlled endpoints — but the breadth is accelerating. The AntV compromise alone touched 323 packages; the TanStack wave hit 84. This isn't a targeted attack on a single supply chain; it's industrial-scale account harvesting across the open-source dependency graph. The read we're settling on: Snyk's disclosure velocity has made it the de facto incident responder for the campaign, surfacing IOCs and connecting dots faster than package registries, CISA, or affected vendors. That's strategically valuable — each writeup reinforces Snyk's position as the early-warning system for supply chain risk — but it also reveals a systemic gap. PyPI and npm still lack mandatory 2FA for maintainers of high-impact packages, GitHub's OIDC token scoping remains permissive enough to enable cross-repo compromise, and the time-to-detection window (hours to days) means thousands of CI/CD pipelines are ingesting malicious code before yanks propagate. Snyk is winning the narrative, but the infrastructure layer isn't hardening fast enough to stop the next wave.
The rest of this story is for subscribers.
Including Our Take, the Tailwinds & headwinds framing, Connections across the FOBI roster, and What should you do.
Already subscribed? Sign in →
