Podcast Examines Malicious npm and RubyGems Supply-Chain Attacks
Summary
The episode analyzes a compromised Tensorlake npm SDK, a fake interview repo that redirects installs through an npm mirror, and 42 malicious RubyGems packages targeting crypto developers.
Key points
- The compromised Tensorlake SDK included a preinstall hook that launched a payload with Bun and a file containing a credential stealer and self-propagating worm; the package was removed within hours.
- The Tensorlake attack reused patterns from the open-source Mini Shai-Hulud worm. The speakers reported no known impact from this iteration.
- A fake job-interview repository planted a custom .npmrc so a later npm install resolved a package through the Chinese mirror npmmirror[.]com; the attack was not attributed.
- The episode discusses how malicious behavior can emerge from dependency combinations even when individual packages contain no malicious payload.
- One RubyGems account, Ghost Dev, published 42 malicious gems targeting crypto and Web3 developers through typosquatting, brandjacking, and plausible utility names.
- The gems' build scripts delayed execution for 20–40 minutes, then opened a reverse shell or installed wallet-stealing malware; the reported capabilities included clipboard hijacking and harvesting wallet secrets.
Article Details
- Attack Vectors
- A compromised Tensorlake SDK package included setup.mjs, which ran through a preinstall hook and launched a payload with Bun; math_symbol.js contained a credential stealer and self-propagating worm.
- A fake interview repository planted a custom .npmrc that redirected a later npm install to a Chinese npm mirror to resolve a package unavailable from the public registry.
- Malicious RubyGems packages used a native extension build script that slept for 20 to 40 minutes before opening a reverse shell or installing a wallet-theft payload.
- The RubyGems payload hijacked clipboard cryptocurrency addresses, replaced them with an operator wallet address, and harvested wallet vaults and secrets.
- Defensive Notes
- Tensorlake users were advised to ensure they were not using the compromised SDK version.
- The hosts said package scanning should detect known malicious preinstall-hook and payload patterns.
- The discussion noted that scanners can miss malicious behavior assembled across multiple packages and dependencies.
MITRE ATT&CK
T1059.006 · PythonA Python payload was included as a later stage of the Ruby package attack.T1059.007 · JavaScriptThe Tensorlake package's setup.mjs ran as a preinstall hook and launched the payload with Bun.T1105 · Ingress Tool TransferThe Ruby package's later-stage payload downloaded additional code.T1115 · Clipboard DataThe RubyGems payload inspected and hijacked clipboard cryptocurrency addresses, replacing them with an operator wallet address.T1195.001 · Compromise Software Dependencies and Development ToolsMalicious npm and RubyGems packages were distributed through software package ecosystems.
People
Threat Actors
Malware
ChainDropstealer and self-propagating worm. It is at least the second attack built on the open-sourced Mini Shai-Hulud worm, following the August attack on keyv and cachable. We discuss why this well-known pattern shouldMiasmalast several versions of this, right? And I think that people have, you know, over the course of the, the MIASMA and the Mini Shai-Hulud iterations, you know, have worked on some form of, excuse me, um, you know, way
Products
Bunwith two malicious files. A setup.mjs file fires through a preinstall hook and launches the payload with Bun, and math_symbol.js carries a credential stealer and self-propagating worm. It is at least the secondGitHubprobably had access to some LLMs and some automation, and, uh, somehow managed to get access to the GitHub repository for this, uh, Tensorlake project. Um, I think it took them a little bit of time to detect it,npmTensorlake SDK compromise: The npm SDK for Tensorlake, a tool for building and operating AI agents, was compromised with two malicious files. A setup.mjs file fires through a preinstall hook and launches the payloadRubyGemsMalicious crypto gems on RubyGems: OpenSourceMalware's automated detection flagged 42 malicious gems published by a single account calling itself Ghost Dev. They target crypto and Web3 developers through typosquats,Tensorlake SDKTensorlake SDK compromise: The npm SDK for Tensorlake, a tool for building and operating AI agents, was compromised with two malicious files. A setup.mjs file fires through a preinstall hook and launches the payload
Industries
Cryptocurrencyof typo squatting, brandjacking, plausible utility names, um Uh, with a, essentially it's a cryptocurrency theft kit included in it.Web3flagged 42 malicious gems published by a single account calling itself Ghost Dev. They target crypto and Web3 developers through typosquats, brandjacking, and plausible utility names. Installing the gem runs a native