Compromised Tensorlake npm Package Delivered Shai-Hulud Credential-Stealing Worm
Summary
Tensorlake npm version 0.5.144 contained a worm that steals credentials, propagates through packages linked to a victim’s publishing identity, establishes persistence, and can execute attacker-supplied code. Users should remove it and rotate credentials.
Key points
- The compromised Tensorlake SDK version 0.5.144 was published to npm and is no longer available from the registry.
- A preinstall hook launches an obfuscated loader and a Bun-based worm that harvests credentials from local files, CI environments, Kubernetes, and Vault.
- The malware exfiltrates stolen data through multiple channels, including an attacker-controlled endpoint and a public GitHub repository fallback.
- It can enumerate packages associated with the victim’s publishing identity and republish compromised versions.
- The malware establishes persistence and can execute remotely supplied code; revoking a stolen GitHub token may trigger a handler designed to wipe the home directory.
- Malicious files were pushed to the Tensorlake repository on October 7, 2026, and version 0.5.144 was published the following day.
- Users who installed the compromised version are advised to remove it and rotate credentials.
Article Details
- Attack Vectors
- Compromise of the npm package tensorlake version 0.5.144 through a malicious preinstall hook and obfuscated JavaScript payload.
- Self-propagation by enumerating packages associated with the victim's publishing identity and republishing compromised versions.
- Credential and secret theft from local files, CI environments, Kubernetes, and Vault sources.
- Exfiltration to attacker infrastructure and, as a fallback, staging encrypted stolen data in a public GitHub repository.
- Persistence through files planted in repositories to trigger execution when opened in Claude Code or VS Code.
- A PowerShell monitor checks a stolen GitHub token; if the token is revoked, it runs attacker-supplied code that can wipe the home directory.
- Defensive Notes
- Users who installed version 0.5.144 are advised to remove it immediately and rotate their credentials.
- The article reports that version 0.5.144 is no longer available from the npm package registry.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | iseekaigogo[.]com | Attacker-controlled domain used as a command-and-control endpoint and for data exfiltration. |
MITRE ATT&CK
T1059.001 · PowerShellA PowerShell monitor invokes attacker-supplied code with Invoke-Expression, including code that can wipe the home directory.T1195.002 · Compromise Software Supply ChainThe attacker compromised the tensorlake npm package and distributed the payload through version 0.5.144.T1552.001 · Credentials In FilesThe malware harvests credentials and secrets from local files.T1567.001 · Exfiltration to Code RepositoryThe malware can stage encrypted stolen data in a public GitHub repository.
People
Malware
ChainDropcompromise of hundreds of npm packages, including Keyv and Cacheable, that were found to contain a Mini Shai-Hulud variant with a self-propagating credential-stealing worm delivered through an obfuscated Bun-basedShai-HuludThe npm package known as "tensorlake," a TypeScript software development kit (SDK) for Tensorlake applications, sandboxes, and cloud services, was compromised as part of a ChainDrop / Shai-Hulud supply chain attack.
Products
Claude Code"The malware also writes .claude/settings.json and .vscode/tasks.json files into repos it can reach, so it runs again when someone opens the project in Claude Code or VS Code," StepSecurity's Ashish Kurmi said.GitHubSocket explained. "Strings referencing a fake Copilot/Dependabot workflow suggest it also plants GitHub Actions workflows."KubernetesThe stealer malware is designed to harvest credentials across local files, CI environments, Kubernetes, and Vault sources. It also drops the HackBrowserData binary, exfiltrates the collected data, establishesnpmThe npm package known as "tensorlake," a TypeScript software development kit (SDK) for Tensorlake applications, sandboxes, and cloud services, was compromised as part of a ChainDrop / Shai-Hulud supply chain attack.TensorlakeThe npm package known as "tensorlake," a TypeScript software development kit (SDK) for Tensorlake applications, sandboxes, and cloud services, was compromised as part of a ChainDrop / Shai-Hulud supply chain attack.Vaultstealer malware is designed to harvest credentials across local files, CI environments, Kubernetes, and Vault sources. It also drops the HackBrowserData binary, exfiltrates the collected data, establishes persistenceVS Code"The malware also writes .claude/settings.json and .vscode/tasks.json files into repos it can reach, so it runs again when someone opens the project in Claude Code or VS Code," StepSecurity's Ashish Kurmi said.