Over 170 packages across multiple high-profile NPM and PyPI projects were compromised in a new, coordinated Mini Shai-Hulud software supply chain attack. The campaign hit 42 TanStack packages, 65 UiPath packages, Mistral AI’s PyPi packages, the OpenSearch JavaScript client, over a dozen Squawk packages, the Guardrails AI PyPI package, and other popular modules. TeamPCP, the infamous hacking group that orchestrated several supply chain attacks across multiple open source software ecosystems over the past few months, was blamed for the campaign. Dead-drop commit branch names used in the attack are taken from Frank Herbert’s Dune saga, and the malware’s repositories have the “Shai-Hulud: Here We Go Again” description. The same as in previous campaigns, the Mini Shai-Hulud worm targets…