Mini Shai-Hulud: Frequently asked questions about the TeamPCP npm and PyPI supply chain campaign

A self-propagating worm has compromised more than 170 npm and PyPI packages, defeating provenance attestation and breaching OpenAI and Mistral AI. Key takeaways Mini Shai-Hulud is a self-propagating worm by TeamPCP that steals developer and cloud credentials across the npm and PyPI ecosystems. The campaign achieved a critical security first by compromising packages with valid SLSA Build Level 3 provenance attestations , proving that process integrity controls can b