A malicious release of tensorlake, the npm software development kit (SDK) for Tensorlake’s AI agent infrastructure, was published on October 8 carrying a variant of the Shai-Hulud worm, which steals developer credentials and tries to spread itself to other packages, according to several security firms that analyzed it. Anyone who installed version 0.5.144 is advised to treat the machine as fully compromised.

The bad version went live on the npm registry at 01:12:07 UTC, and software supply-chain security firm Socket said it flagged it about 11 minutes later. According to Endor Labs, the release has since been removed from the registry, and version 0.5.143 and earlier are not affected. Socket and Endor Labs both put the package at roughly 12,000 weekly downloads; Socket noted that the figure reflects overall usage, not downloads of the malicious version or confirmed infections.

A trusted pipeline, a poisoned source

The compromise began upstream of npm. Endor Labs traced the first malicious commit in the project’s GitHub repository to 01:20 UTC on October 7. The release then went out through the project’s normal GitHub Actions pipeline and carried valid build provenance. “Provenance confirms where a build came from, not that the source was clean,” the Endor Labs researchers wrote.

Snyk‘s advisory says an attacker used a repository administrator account to commit the payload directly to the main branch through the GitHub web interface, which triggered the automated release workflow. Aikido Security said the commits appeared as verified commits under a maintainer’s identity and that the repository was compromised for about 20 hours before the publish. Endor Labs called a compromised maintainer account the most likely root cause.

Endor Labs said six platform-specific binary packages, published as tensorlake-native at version 0.5.144 in the same release run, contained no payload or install script it could find, but should still be treated as affected. Tensorlake also distributes packages on PyPI and Cargo; Aikido said there was no sign the attacker could publish to either at the time it wrote its analysis.

What the malware does

The package runs a preinstall script, so the code executes during installation even if the SDK is never imported, Socket said. A small obfuscated loader installs the Bun JavaScript runtime and uses it to launch a larger obfuscated payload, according to Aikido and Snyk.

The credential sweep is broad: npm and GitHub tokens, SSH keys, AWS, Google Cloud and Azure credentials, Kubernetes and HashiCorp Vault secrets, CI and registry tokens, and .env files, according to Endor Labs. Socket, Aikido and Snyk added cryptocurrency wallets, browser credential stores, messaging app data and configuration files for AI development tools to the list. On cloud hosts, Endor Labs said, the payload also queries instance metadata services for short-lived cloud credentials.

The worm then uses stolen npm and GitHub credentials to republish itself into other packages the victim controls, Endor Labs and Socket said. Socket reported that it generates Sigstore provenance for those republished versions and appears to plant a fake GitHub Actions workflow disguised as Copilot or Dependabot. It finds its command server through a lookup in an Ethereum smart contract, according to Snyk, Aikido and Socket. Socket said the hook and file structure match the August ChainDrop and Shai-Hulud compromises of keyv, cacheable and related packages.

Revoking tokens first can backfire

The payload includes a dead-man’s switch. Socket said a persistent monitor polls GitHub with the stolen token, and if the token is revoked, it runs an attacker-supplied handler; Socket and Snyk described the result as a destructive wipe of the user’s home directory. Socket’s guidance is to remove that persistence from affected Linux, macOS and Windows hosts before revoking any credentials, and it published platform-specific removal steps.

The vendors’ remediation advice overlaps:

  • Search manifests, lockfiles, build logs, caches and deployed artifacts for tensorlake 0.5.144, and pin to 0.5.143 until a known-good release ships (Socket, Endor Labs).
  • Treat any host or CI runner that installed the release as fully compromised, isolate it, and rebuild from trusted sources (Aikido, Snyk, Socket).
  • After the persistence is removed, rotate npm and GitHub tokens, SSH keys, cloud keys and any other secrets on that machine, using a clean system (Endor Labs, Socket).
  • Review GitHub and npm accounts for unexpected repositories, new tokens or unexplained package publishes (Endor Labs, Socket).
  • Consider installing with lifecycle scripts disabled where practical, since this payload depends on a preinstall hook (Endor Labs).

Why it matters

The incident shows the limits of build provenance: it records where a package was built, not whether the code that went into it was legitimate, as Endor Labs noted. Once an attacker controlled an account able to commit to the main branch, the project’s own release pipeline shipped the malware.

The token-triggered wipe also changes incident response. The usual first instinct, revoking exposed tokens immediately, can trigger the destructive handler if the persistent monitor is still running, so the order of cleanup steps matters as much as their speed.

The caveats

The technical details come from analyses published by security vendors on the day of the release, and accounts differ slightly, for example on whether the payload carries a hardcoded command domain in addition to its blockchain lookup. None of the vendor pages included a statement from Tensorlake.

Corrections and tips: email the editor using the address on the Contact page.