Version 0.5.144 of the tensorlake npm package, Tensorlake's TypeScript SDK, was published with a preinstall hook that steals developer and cloud credentials and then uses them to spread. If any machine installed it, treat that machine's secrets as stolen. Before you revoke anything, remove the malware's token monitor, which is built to retaliate when a stolen GitHub token stops working.
What happened
Socket reports that tensorlake@0.5.144 was published on October 8, 2026 at 01:12:07 UTC and that its scanner flagged it about 11 minutes later. Socket puts the package at roughly 12,000 weekly downloads and attributes the attack to the ChainDrop/Shai-Hulud campaign, which hit the keyv and cacheable packages in August.
StepSecurity traced the code back a day earlier. The first malicious commit landed on the tensorlakeai/tensorlake main branch on October 7 at 01:20 UTC under a maintainer's identity, skipping pull request review. Seven more commits followed, and the project's release workflow published from that branch. StepSecurity notes the package carries a valid npm provenance attestation, which proves where it was built, not that the code is safe. StepSecurity names 0.5.143 as the safe version, and The Hacker News reports 0.5.144 has been removed from the registry.
According to Socket, the hook runs lib/setup.mjs at install time. StepSecurity says this downloads the Bun runtime to run an obfuscated Math_Symbol.js payload. Socket lists the targets as npm tokens, GitHub tokens, AWS credentials (IMDS, ECS, Secrets Manager, SSM), HashiCorp Vault, Kubernetes service accounts, SSH keys, .env files, crypto wallets, and AI tool configs including .claude, .cursor, .kiro, Windsurf and Zed.
Socket says the worm lists the victim's own npm packages, builds Sigstore provenance for them and republishes compromised versions. StepSecurity adds that it commits files such as .claude/settings.json and .vscode/tasks.json with "chore: update dependencies" messages, and that the payload skips CI environments to focus on developer machines.
Why it matters
The hostage-token mechanism changes the usual incident response order. Socket describes a PowerShell monitor, persisted through an ONLOGON scheduled task, that keeps checking the stolen GitHub token and runs a destructive handler if the token is revoked. StepSecurity describes a gh-token-monitor service that checks every 60 seconds for up to 24 hours and deletes the user's home directory, or on Windows uses PowerShell to delete the user profile. Revoke first and you may lose the workstation.
This is also a non-human identity problem. A developer laptop holds publish tokens, cloud keys, Vault tokens and kubeconfigs, each leading somewhere else. The worm publishes in the victim's name, so one install can become an incident for everyone downstream. And the entry point was a maintainer identity pushing straight to main: a branch protection gap, not a code bug.
What to check in your environment
- Search manifests and lockfiles in every repo and build cache for
tensorlakeat 0.5.144. Pin to 0.5.143 and clearnode_modulesand the npm cache, per StepSecurity. - List every machine that installed it on or after October 8 and isolate those hosts before taking any other action.
- Remove persistence before revoking tokens. Look for the
~/.config/gh-token-monitor/directory and related service, and for an unexpected logon scheduled task on Windows. Socket and StepSecurity both publish per-OS removal steps; follow theirs. - Then rotate everything the host could reach: npm and GitHub tokens, AWS keys, Vault tokens, Kubernetes service account tokens, SSH keys, secrets in
.envfiles, and API keys stored in AI tool configs. - Audit what the stolen tokens could publish. Review recent versions of packages owned by affected developers, new public GitHub repos with a "Shai-Hulud" description, and unexpected
.claude/settings.json,.vscode/tasks.jsonor workflow commits. - Hunt for the IOCs: SHA-256
25a0735d0db7dc40e5d45ce42d9c106067e6a66e184d967cfecfab17c3bcb5ef(setup.mjs),b50a00900399ba99fb6ce1fc151519cb99d44320ef2a631f2237e1aea0ad6fec(Math_Symbol.js), and traffic toiseekaigogo.com, which StepSecurity names as an exfiltration destination. - Close the entry path: require pull requests and reviews on release branches, and limit who can trigger publish workflows.
- Rebuild if unsure. Both firms recommend rebuilding from trusted sources when you can't confirm cleanup.