cyber.hendryadrian.com
Threat Research · sonatype.com

Malicious TensorLake npm Release Could Expose Developer Credentials and GitHub Repositories

· Original article ↗

Summary

Analysis of [email protected] found an install hook that could collect credentials, run remote JavaScript, publish data via a public GitHub repository, and modify accessible repos. Publication, downstream impact and broad CI infection remain unconfirmed.

Key points

  • The [email protected] npm release used a preinstall hook to launch an obfuscated payload through Bun; the package could download Bun 1.3.13 if needed.
  • The payload searched for credentials and AI-tool configuration, sent collected data to remote infrastructure, and polled a command channel for operator-supplied JavaScript.
  • Code analysis found a GitHub fallback that could create a public repository and commit collected data. In one path, a GitHub token with repository scope could be included in the uploaded data and commit message.
  • The code could also commit .claude and .vscode files to accessible repositories, creating a possible route to expose other developers to the payload. Downstream spread was not confirmed.
  • The loader exits when specific CI environment markers are present. This does not establish that CI systems were outside the campaign’s intended scope or that broad CI infection occurred.
  • The payload’s WORMTAG value is "tensrlake"; it may help correlate samples but does not by itself establish a connection.
  • Teams that installed the release should check whether the hook ran, investigate affected hosts and GitHub activity, review credentials accessible to the process, and rebuild from a clean environment.

Article Details

Attack Vectors
  • The malicious [email protected] npm release used a preinstall hook to launch an obfuscated JavaScript payload through Bun.
  • The payload searched local sources and AI-tool configuration files for credentials, polled a command channel, and evaluated operator-supplied JavaScript.
  • A GitHub fallback could create a public repository and commit collected data; in one described path, a repository-scoped GitHub token could also be included in uploaded data and a commit message.
  • The code could commit .claude and .vscode setup and configuration files to eligible branches of repositories accessible to the execution context. Downstream spread or repository modification was not confirmed.
  • The install hook exits when specified CI environment markers are present. The article does not establish broad CI infection or the operator's intent.
Defensive Notes
  • Check manifests, lockfiles, package caches, and build records for [email protected], then determine whether its preinstall hook ran.
  • Investigate affected hosts and development or build environments, and review GitHub audit activity for unexpected access, repository creation, and commits across branches.
  • Inspect .claude, .vscode, and results/ paths, and check for public repositories created during the relevant period.
  • Review HashiCorp Vault audit logs for unexpected credential access and rebuild from a clean environment after investigation.
  • Before revoking a potentially stolen GitHub token, check for the reported token-monitor component; public analysis warns that revocation while it is active may trigger destructive behavior.
  • Rotate credentials available to the process based on the investigation. Removing the package or release does not revoke credentials it may have read or establish whether the payload executed.

MITRE ATT&CK

T1005 · Data from Local SystemThe payload collected data from local sources, including credential and AI-tool configuration files.T1059.007 · JavaScriptThe payload polled a command channel and evaluated JavaScript supplied by the operator.T1102.002 · Bidirectional CommunicationSocket described GitHub as an alternate command-and-control route; the analyzed code also polled a command channel.T1195.002 · Compromise Software Supply ChainThe malicious [email protected] npm release delivered its payload through a package preinstall hook.T1552.001 · Credentials In FilesThe payload searched local sources and configuration files for credentials, including GitHub tokens and HashiCorp Vault credentials.T1567.001 · Exfiltration to Code RepositoryThe GitHub fallback could publish collected data by creating a public repository and committing the data beneath results/.

Products

BunThe affected npm release included a preinstall hook that starts an obfuscated JavaScript payload through Bun.Claudestolen GitHub token in one path, and that the malware could modify accessible repositories by committing .claude and .vscode files.Codextarget files associated with AI development tools, including Claude, Cursor and Kiro MCP configuration, Codex authentication, Gemini OAuth credentials, and Windsurf authentication and configuration.CursorIts collection lists also target files associated with AI development tools, including Claude, Cursor and Kiro MCP configuration, Codex authentication, Gemini OAuth credentials, and Windsurf authentication andGeminiwith AI development tools, including Claude, Cursor and Kiro MCP configuration, Codex authentication, Gemini OAuth credentials, and Windsurf authentication and configuration.GitHubSonatype's code review found that its GitHub fallback could create a public repository and commit collected data, including a stolen GitHub token in one path, and that the malware could modify accessible repositories byHashiCorp VaultThe payload searches local sources for secrets, including GitHub tokens and HashiCorp Vault credentials, and sends collected data to remote infrastructure.KiroIts collection lists also target files associated with AI development tools, including Claude, Cursor and Kiro MCP configuration, Codex authentication, Gemini OAuth credentials, and Windsurf authentication andnpmThe affected npm release included a preinstall hook that starts an obfuscated JavaScript payload through Bun.TensorLake TypeScript SDKThe TensorLake TypeScript SDK's documented purpose is to work with sandboxes, repositories, and cloud services.Windsurfincluding Claude, Cursor and Kiro MCP configuration, Codex authentication, Gemini OAuth credentials, and Windsurf authentication and configuration.

Related Articles