TensorLake npm SDK Version 0.5.144 Compromised in Credential-Stealing Supply-Chain Attack
Summary
Socket reports that tensorlake@0.5.144 runs malware during npm installation to steal credentials, exfiltrate secrets, persist, execute remote code, and spread to other packages. A token monitor may wipe a host if its GitHub token is revoked.
Key points
- The compromised tensorlake@0.5.144 release was published October 8, 2026; Socket flagged it about 11 minutes later.
- A preinstall hook launches an obfuscated loader, so the malware can run during installation without the SDK being imported.
- The payload targets npm and GitHub tokens, cloud and Kubernetes credentials, Vault, SSH keys, environment files, and AI development-tool configurations.
- The worm can use stolen publishing credentials to compromise and republish other npm packages.
- A persistent token monitor polls api[.]github[.]com/user; revoking the monitored GitHub token can trigger a handler that wipes the user's home directory.
- Teams should block the affected version, identify hosts where installation scripts ran, investigate and remove persistence, then revoke and replace exposed credentials.
Article Details
- Attack Vectors
- A compromised tensorlake npm release runs an obfuscated loader through a preinstall hook during installation when dependency lifecycle scripts are permitted.
- The payload harvests credentials and sensitive files, exfiltrates collected data, establishes persistence, executes remotely supplied code, and propagates by republishing compromised npm packages.
- A PowerShell monitor persists through an ONLOGON scheduled task and, after detecting token revocation, runs an attacker-supplied handler.
- Defensive Notes
- Check dependency manifests, lockfiles, build logs, and deployed artifacts for tensorlake@0.5.144; block the affected version and identify environments where its installation scripts ran.
- Treat hosts where the malicious code executed as compromised. Isolate them, investigate persistence, and rebuild from trusted sources.
- Remove the token monitor before revoking credentials: revocation while it is running triggers the reported dead-man switch. Then revoke and replace exposed credentials and audit connected accounts, repositories, and deployment systems.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| SHA256 | 25a0735d0db7dc40e5d45ce42d9c106067e6a66e184d967cfecfab17c3bcb5ef | SHA-256 hash of the malicious package file lib/setup.mjs. |
| SHA256 | b50a00900399ba99fb6ce1fc151519cb99d44320ef2a631f2237e1aea0ad6fec | SHA-256 hash of the malicious credential-stealing payload lib/Math_Symbol.js. |
MITRE ATT&CK
T1053.005 · Scheduled TaskThe token monitor persists through an ONLOGON scheduled task.T1059.001 · PowerShellThe PowerShell monitor runs an attacker-supplied handler through Invoke-Expression.T1195.002 · Compromise Software Supply ChainThe npm SDK release was compromised and distributed through the software supply chain.T1552.001 · Credentials In FilesThe payload harvests credentials from local files, including .npmrc files, SSH keys, .env files, and kubeconfig files.
Malware
Products
AWSAWS credentials and secrets: Instance Metadata Service (IMDS), ECS, Secrets Manager, and Systems Manager Parameter Store (SSM).Bunpackage/lib/setup.mjs — An obfuscated loader invoked by the preinstall hook that launches the payload using Bun.GitHubremotely supplied code. The package receives approximately 12K weekly downloads and has over 1k stars on GitHub.GitHub Actionscompromised versions. Strings referencing a fake Copilot/Dependabot workflow suggest it also plants GitHub Actions workflows.KubernetesSocket’s initial assessment identifies credential harvesting across local files, CI environments, Kubernetes, and Vault sources. The malicious code also exfiltrates collected data, establishes persistence, and supportsnpmSocket detected a compromised release of tensorlake, the npm SDK for Tensorlake’s AI agent infrastructure, in a ChainDrop / Shai-Hulud supply chain attack. Version 0.5.144 contains obfuscated malware that harvestsPowerShellThe “hostage token” component uses a PowerShell monitor that persists through an ONLOGON scheduled task. It polls api.github.com/user using the stolen GitHub token to check whether the token remains valid.TensorlakeSocket detected a compromised release of tensorlake, the npm SDK for Tensorlake’s AI agent infrastructure, in a ChainDrop / Shai-Hulud supply chain attack. Version 0.5.144 contains obfuscated malware that harvestsVaultinitial assessment identifies credential harvesting across local files, CI environments, Kubernetes, and Vault sources. The malicious code also exfiltrates collected data, establishes persistence, and supports