A Legitimate npm Package Turned Into a Credential Vacuum
On October 7, 2026, attackers pushed malicious code into the GitHub repository for tensorlake, a TypeScript SDK used with Tensorlake cloud services and sandboxes. The next day, that code was published to npm as version 0.5.144. If any developer on your team ran a routine install or dependency update, they may have pulled down malware without a single suspicious click.
That’s the part that matters to your business. You don’t have to visit a shady site or open a phishing email. You install a package you’ve used before, and the attacker is already inside your CI pipeline, your cloud environment, and your developer’s machine.
What the Malware Actually Does
The compromised version contains a preinstall hook that fires before the package even finishes installing. It launches an obfuscated loader, which then runs the main worm using the Bun JavaScript runtime. According to Socket’s analysis, the malware goes after a wide range of secrets in one pass.
- npm and GitHub tokens
- AWS credentials and secrets
- HashiCorp Vault and Kubernetes credentials
- SSH keys and .env files
- Cryptocurrency wallets
- Configuration files for AI coding tools including Anthropic Claude, Cursor, Windsurf, and Zed
It also drops a binary called HackBrowserData to pull credentials stored in browsers, then exfiltrates everything to an attacker-controlled server. The C2 address is resolved through an Ethereum smart contract, with GitHub used as a fallback to stage stolen data in a public repository.
This connects directly to a broader risk we’ve written about before. If your developers use AI coding assistants, those tools store configuration and authentication data that this worm specifically targets. The post on AI coding tools and cloud credential theft covers why that attack surface is growing faster than most teams realize.
The Worm Part Is What Makes This Worse
Most credential stealers grab what they can and leave. Shai-Hulud doesn’t stop there. It enumerates npm packages tied to the victim’s publishing identity, then republishes compromised versions to spread further. It also plants GitHub Actions workflows and writes files into any reachable repository so it runs again when someone opens the project in VS Code or Claude Code.
There’s also a “hostage token” mechanism. If you try to revoke a stolen GitHub token, a PowerShell monitor detects the revocation and executes attacker-supplied code in response, likely triggering a destructive routine. Revoking credentials is still the right move, but it has to be done carefully and completely, not just one token at a time.
What to Do Right Now
Version 0.5.144 is no longer available on npm, but removal from the registry doesn’t clean up machines that already installed it. If anyone on your team pulled this version between October 7 and October 8, 2026, treat the environment as compromised.
Rotate every secret that process could have touched: AWS keys, GitHub tokens, SSH keys, anything in .env files, and any credentials stored in the browsers on that machine. Check your GitHub Actions workflows for anything you didn’t write. Audit recent npm publishes from your organization’s accounts.
For teams running CI/CD pipelines, lock your dependency versions and verify package integrity before merging updates. This attack is part of the same ChainDrop campaign that compromised hundreds of packages including Keyv and Cacheable starting in early August 2026, so this isn’t a one-off incident to treat as closed.
Supply chain attacks are getting harder to catch because the compromise happens at a layer most security tools don’t watch. If your team doesn’t have visibility into what’s running during npm installs or what your CI environment is reaching out to, that’s a gap worth closing. Exine helps small and mid-size businesses get that visibility through managed IT and cybersecurity for businesses built around how development teams actually work.
FAQ
How do I know if my team installed the malicious tensorlake package?
Check your package-lock.json or yarn.lock files for tensorlake version 0.5.144. Also review npm install logs from October 7 and 8, 2026. If you find it, assume all secrets accessible to that process are compromised and rotate them immediately before revoking tokens.
Does removing the package fix the problem?
No. The malware establishes persistence and may have written files into other repositories. Removing the package stops future execution but doesn’t undo credential theft or clean up planted workflows. A full credential rotation and environment audit are required.
Are businesses that don’t write code at risk from this?
Generally no, but any business using contractors or internal developers who work with npm packages could be exposed. If your team uses AI coding tools like Cursor or VS Code with extensions, the attack surface is broader than most non-technical owners expect.
What is a supply chain attack in plain terms?
Instead of attacking your systems directly, attackers compromise a tool or library your developers already trust and use. When your team installs a routine update, the malware comes along with it. You did nothing wrong, but the damage is the same as a direct breach.
