TeamPCP Hits TanStack, OpenSearch, and Mistral with Mini Shai-Hulud

TeamPCP's "Mini Shai‑Hulud" is a self‑propagating npm supply‑chain worm that compromised 170 npm packages (19 namespaces) — including high‑impact packages like @opensearch-project/opensearch and Mistral clients — and crossed into PyPI; the worm steals CI credentials via an orphaned TanStack CI run (OIDC token theft), mints publish tokens, republishes packages with valid Sigstore provenance, exfiltrates harvested secrets over the Session P2P network, and persists by injecting files and GitHub workflow commits into downstream repositories, with full IOCs and remediation steps provided.