Security researchers at Socket have identified a supply chain attack affecting multiple npm packages, including widely-used tools from Mistral, UiPath, and TanStack's react-router. The compromise is attributed to the Mini Shai-Hulud attack campaign.
A significant npm supply chain attack has compromised packages from several major organizations, according to Socket's threat intelligence team. The affected libraries include tools from AI platform Mistral, enterprise automation company UiPath, and TanStack's popular web development utilities—most notably react-router, a foundational library for React applications.
The attack, labeled Mini Shai-Hulud, represents another instance of threat actors targeting the JavaScript ecosystem through compromised dependencies. This attack vector remains effective because developers often rely on transitive dependencies without directly vetting their security.
Socket recommends immediate action for affected developers: run shasum -a 256 verification on all router_init.js files throughout your dependency tree. This checksum validation can help identify whether your installation includes the malicious versions.
The scope of the compromise underscores the vulnerability of open-source package registries. Even popular, actively-maintained libraries can become attack vectors when maintainer credentials are compromised or when typosquatting tactics succeed. Organizations using react-router or other affected packages should audit their supply chains and review recent deployment logs for suspicious activity.
Developers are advised to:
- Verify package integrity using checksums
- Review package.lock or yarn.lock files for unexpected changes
- Monitor for any suspicious behavior in production environments
- Update affected packages to patched versions once available
This incident follows a pattern of increasing supply chain attacks targeting the npm ecosystem. The JavaScript community continues to grapple with balancing open-source accessibility against security risks. Package managers and registries have implemented additional safeguards, but attacks like Mini Shai-Hulud demonstrate that vigilance remains essential for development teams managing dependencies at scale.
Cyberattacks against hedge funds and private equity firms have been attributed to UNC6671, an extortion group connected to the BlackFile threat actors. The campaign represents an escalating threat to the financial sector.
A Go-based malware distributed through ClickFix attacks is targeting macOS users to steal cryptocurrency, passwords, and Apple Keychain data. The infostealer campaign combines social engineering with credential harvesting.
A former NSA official has warned against connecting water infrastructure controllers to the internet following suspected Iranian cyberattacks on U.S. water systems.
Security researchers scanning Polish government websites discovered critical vulnerabilities that could expose courts, hospitals, and airports to cyberattacks. The vulnerabilities stem from common software used to manage and display web content.