Shai-Hulud Variant Found in Compromised Tensorlake npm Package
Summary
Aikido reports that Tensorlake npm 0.5.144, published after a repository compromise, carried a Shai-Hulud variant that steals secrets, targets browser-wallet data and can spread through connected supply chains.
Key points
- Aikido reports that a threat actor published compromised Tensorlake npm version 0.5.144 on October 8, 2026, after compromising the GitHub repository for about 20 hours; it found no sign of releases to PyPI or Cargo.
- A preinstall script runs an obfuscated setup script that drops Bun and launches the Shai-Hulud payload.
- The malware attempts to steal environment variables and local secrets, and targets browser data from 14 cryptocurrency extensions; it also fetches HackBrowserData to seek additional browser credentials.
- The payload includes persistence and proliferation components and a dead-man’s switch that wipes infected machines if an embedded GitHub token is revoked.
- The malware has a hardcoded C2 at iseekaigogo[.]com and uses an Ethereum contract to resolve an alternate C2; the contract’s reported current value points to the same domain.
- Aikido recommends treating infected systems as fully compromised and rotating their secrets and credentials.
Article Details
- Attack Vectors
- A compromised tensorlake npm package, version 0.5.144, ran malicious code through its preinstall script.
- The malware used Bun to execute an obfuscated Shai-Hulud payload.
- The malware attempted to steal secrets from environment variables, local credential files, and browser stores, including cryptocurrency-extension data.
- The malware retrieved a HackBrowserData binary from its C2 server and used it to attempt further browser credential theft.
- The malware exfiltrated stolen data to a hardcoded C2 domain and could resolve an alternate C2 domain through a threat-actor-controlled Ethereum contract.
- The malware attempted to spread through connected software supply chains and could wipe infected machines if an embedded GitHub token was revoked.
- Defensive Notes
- Treat any system or environment infected by the package as fully compromised.
- Rotate all secrets and credentials present in an infected environment as a critical priority.
- Check npm installations for tensorlake version 0.5.144 and review affected systems for the identified malicious files.
- Aikido recommends checking its central feed for malware issues and triggering a manual rescan.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | iseekaigogo[.]com | Hardcoded C2 domain used by the malware for command and control and data exfiltration; also set as the contract-resolved C2 value. |
| SHA256 | 25a0735d0db7dc40e5d45ce42d9c106067e6a66e184d967cfecfab17c3bcb5ef | SHA-256 hash of the obfuscated malicious setup.mjs script that drops Bun and launches the payload. |
| SHA256 | b50a00900399ba99fb6ce1fc151519cb99d44320ef2a631f2237e1aea0ad6fec | SHA-256 hash of the malicious Math_Symbol.js file containing the obfuscated Shai-Hulud payload. |
MITRE ATT&CK
T1041 · Exfiltration Over C2 ChannelThe malware attempted to exfiltrate environment variables, local secrets, and browser data through its C2 infrastructure.T1059.007 · JavaScriptThe package's preinstall script invoked Node.js to run setup.mjs, which launched the malicious JavaScript payload.T1105 · Ingress Tool TransferThe malware downloaded a HackBrowserData binary from its C2 address for execution on the infected system.T1195.002 · Compromise Software Supply ChainThe threat actor published a compromised tensorlake package to npm, introducing malware through a software dependency.T1485 · Data DestructionThe malware's dead-man's switch was designed to wipe infected machines if an embedded GitHub token was revoked.T1552.001 · Credentials In FilesThe malware attempted to read local credential and secret files, including cloud, SSH, and wallet-related files.T1555.003 · Credentials from Web BrowsersThe malware attempted to obtain credentials from browser stores and cryptocurrency browser-extension data.