What happened
On October 8, 2026, at 01:12 UTC, version 0.5.144 of the npm package tensorlake, the SDK for a serverless sandbox platform for AI agents, was published with a Shai-Hulud-family worm that steals credentials. The package gets about 12,000 to 18,000 weekly downloads. The version was live for about 1h40m, according to the maintainers' advisory, which says telemetry showed no use of it. Socket flagged the malicious version 11 minutes after it was published.
Tensorlake's PyPI and Cargo packages were not affected, according to published analyses.
How they got in
The attack didn't start on npm but on GitHub:
- On October 7, the attacker pushed commits directly to the main branch of tensorlakeai/tensorlake through the web UI, using a maintainer's admin account, with no pull request.
- Eight commits tuned the payload and added a preinstall hook to package.json.
- About 20 hours later, the same account manually triggered the official publish workflow.
The result: the package shipped with a valid provenance attestation. As StepSecurity notes, the attestation says where the package was built, not that the code is safe.
What the malware does
- The preinstall hook runs an obfuscated loader that downloads the Bun runtime and executes an 856 KB payload.
- It steals npm and GitHub tokens, cloud, Kubernetes and Vault credentials, and AI coding tool config files.
- It tries to spread: it republishes the user's other packages and commits .claude and .vscode files to their repos, with the fake author "claude@users.noreply.github.com" and the message "chore: update dependencies".
- Hostage token: it installs a monitor that checks the stolen GitHub token every 60 seconds for up to 24 hours. If the token is revoked, it wipes the home directory (rm -rf ~/ on Linux and macOS). Researchers disagree on exactly when the trap arms.
The two-file pattern (setup.mjs and Math_Symbol.js) matches the August attacks on the keyv and cacheable packages, built on the "mini Shai-Hulud" code the TeamPCP group released. There is no proof it's the same group.
What to do if you installed it
- Before revoking tokens, isolate the machine and kill the monitoring process, so you don't lose your home directory.
- Treat every credential on the machine as compromised: npm, GitHub, cloud and AI agent configs. Then rotate everything.
- Look for "chore: update dependencies" commits from odd authors and new workflows in your repos.
- Check recently published versions of your own packages.
Lessons
- Require review on every push to main, including from admins.
- Use hardware keys (FIDO2) on maintainer accounts.
- Adopt a cooldown period before installing freshly published versions, and disable install scripts where you can.
- AI coding tools are now a target: their configs hold valuable keys.
Sources
- Tensorlake security advisory (GHSA-8g63-53c9-65j2): https://github.com/tensorlakeai/tensorlake/security/advisories/GHSA-8g63-53c9-65j2
- Socket: https://www.socket.dev/blog/tensorlake-compromise
- StepSecurity: https://www.stepsecurity.io/blog/tensorlake-npm-compromised-hostage-token-worm
- Aikido: https://www.aikido.dev/blog/tensorlake-npm-package-compromised
Want to protect your software supply chain and pipelines? KGA IT offers a free consultation: kga-it.com.