StepSecurity Details Tensorlake npm Malware That Steals Credentials and Can Wipe Home Directories
Summary
StepSecurity says [email protected] steals credentials, spreads through npm packages and GitHub repositories, and can delete a user's home directory if its stolen GitHub token is revoked while a monitor is active.
Key points
- StepSecurity reports that [email protected] runs a preinstall hook on developer machines; it skips execution in CI.
- The malware targets GitHub and npm tokens, cloud keys, Kubernetes and Vault secrets, SSH keys, browser logins, and AI-tool configuration.
- With stolen tokens, it can republish infected npm packages and add files to repositories that run again when opened in Claude Code or VS Code.
- A gh-token-monitor service checks the stolen GitHub token every 60 seconds for up to 24 hours; if the token is rejected, the malware attempts to delete the user's home directory.
- StepSecurity says the package was published from the repository's main branch with valid npm provenance, which attests to build origin but does not establish that code is safe.
- The article advises affected users to remove the token monitor before revoking tokens, then rotate credentials; it recommends pinning tensorlake to 0.5.143.
Article Details
- Attack Vectors
- The compromised [email protected] npm release runs a preinstall hook on developer machines; the hook skips CI.
- The hook downloads the Bun runtime and uses it to execute an obfuscated 856 KB payload.
- The payload steals GitHub and npm tokens, cloud keys, Kubernetes and Vault secrets, SSH keys, saved browser logins, and AI-tool configuration files.
- Stolen data is encrypted and sent to a public GitHub repository created in the victim's account or to iseekaigogo.com.
- With a stolen npm token, the malware adds itself to the victim's packages, bumps their versions, and republishes them.
- With a stolen GitHub token, it adds .claude/settings.json and .vscode/tasks.json files to accessible repositories, enabling execution when projects are opened in Claude Code or VS Code.
- The malware installs gh-token-monitor, which checks the stolen GitHub token every 60 seconds for up to 24 hours and deletes the user's home directory if GitHub rejects the token.
- Defensive Notes
- If [email protected] was installed, remove and stop gh-token-monitor before revoking any GitHub token; the article warns that revocation while the monitor runs triggers data destruction.
- Pin tensorlake to 0.5.143, remove node_modules, clean the npm cache, and set ignore-scripts=true in .npmrc to prevent package install hooks from running.
- After removing the monitor, rotate GitHub and npm tokens, cloud keys, SSH keys, Kubernetes and Vault credentials, .env secrets, AI-tool keys, and browser-saved passwords.
- Check for newly created public repositories with the description "Shai-Hulud: Here We Go Again", commits attributed to [email protected], and unexpected .claude or .vscode files.
- If the machine cannot be confidently cleaned, wipe it and start fresh. If the package ran only in CI, rotate secrets that the job could access.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | iseekaigogo[.]com | Domain to which the malware sends encrypted stolen data. |
claude@users[.]noreply[.]github[.]com | Fake commit author address used by the malware when adding files to victims' GitHub repositories. | |
| SHA256 | 25a0735d0db7dc40e5d45ce42d9c106067e6a66e184d967cfecfab17c3bcb5ef | SHA-256 identified by StepSecurity for the malicious lib/setup.mjs file in [email protected]. |
| SHA256 | b50a00900399ba99fb6ce1fc151519cb99d44320ef2a631f2237e1aea0ad6fec | SHA-256 identified by StepSecurity for the malicious lib/Math_Symbol.js file in [email protected]. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe malware payload is described as an obfuscated 856 KB file.T1053.005 · Scheduled TaskOn Windows, gh-token-monitor runs as a logon task in Task Scheduler.T1059.001 · PowerShellOn Windows, the token monitor uses a PowerShell deletion command to remove the user's profile.T1059.004 · Unix ShellThe token monitor uses rm -rf ~/ to delete the user's home directory on Unix-like systems.T1059.007 · JavaScriptThe package's preinstall hook runs setup.mjs, which uses Bun to execute the obfuscated payload.T1105 · Ingress Tool TransferThe preinstall hook downloads the Bun runtime before executing the payload.T1195.002 · Compromise Software Supply ChainThe attacker inserted malicious files into the tensorlake repository and published them as the [email protected] npm package.T1485 · Data DestructionIf GitHub rejects the monitored token, gh-token-monitor deletes the user's home directory or Windows user profile.T1528 · Steal Application Access TokenThe malware steals GitHub and npm tokens.T1543.001 · Launch AgentThe article describes installing gh-token-monitor as a macOS LaunchAgent.T1543.002 · Systemd ServiceThe malware installs gh-token-monitor as a user systemd service on Linux.T1552.001 · Credentials In FilesThe malware steals secrets and configuration files, including .env files and Kubernetes and Vault credentials.T1552.004 · Private KeysThe malware steals SSH keys.T1555.003 · Credentials from Web BrowsersThe malware steals saved browser logins.T1567.001 · Exfiltration to Code RepositoryThe malware sends encrypted stolen data to a public GitHub repository created in the victim's account.
Vendors
GitHubyou install it, then tries to spread to other packages and repos. It also sets a trap. If you revoke the GitHub token it stole, a background job on your machine deletes your home directory.npm[email protected] on npm steals credentials when you install it, then tries to spread to other packages and repos. It also sets a trap. If you revoke the GitHub token it stole, a background job on your machine deletes
Products
Bunhook runs setup.mjs. It skips itself on CI, so developer machines are the target. It downloads the Bun runtime and uses it to run an obfuscated 856 KB file. We decoded that file without running it.Claude CodeThe malware also writes .claude/settings.json and .vscode/tasks.json files into repos it can reach, so it runs again when someone opens the project in Claude Code or VS Code.Tensorlake[email protected] on npm steals credentials when you install it, then tries to spread to other packages and repos. It also sets a trap. If you revoke the GitHub token it stole, a background job on your machine deletesVS CodeThe malware also writes .claude/settings.json and .vscode/tasks.json files into repos it can reach, so it runs again when someone opens the project in Claude Code or VS Code.