Tensorlake npm Compromised: Shai-Hulud Worm Targets AI Developer Credentials

The Tensorlake npm SDK was compromised on October 8, 2026. Version 0.5.144 shipped a self-propagating credential-stealing worm — the latest variant of the Shai-Hulud malware family — that executed automatically during npm install. You did not need to import the package or run any application code. Just installing it was enough. If you did, your cloud credentials, GitHub tokens, SSH keys, and AI tool configurations were exfiltrated within seconds. And here is the part that gets worse: if you revoke your GitHub token before removing the attacker’s background monitor, it will wipe your home directory.

How the Attack Happened #

The intrusion started on October 7, 2026 at 01:20 UTC. Attackers compromised a verified maintainer’s GitHub account and pushed a malicious commit directly to the main branch via the GitHub web UI. They then manually dispatched the project’s publish_npm.yaml workflow, which built and signed the release with Sigstore provenance — the same provenance that is supposed to be a signal of trustworthiness. The package landed on npm looking completely legitimate. Socket Security detected it 11 minutes after publication. That is fast. It is not fast enough to stop CI/CD pipelines that pull on every commit.

The malicious release added a preinstall lifecycle hook to the package manifest. npm executes preinstall hooks before any application code runs, automatically, as part of the install process. The hook launched an obfuscated (lib/setup.mjs) via Bun — not Node.js, which is worth noting because many security controls watch Node.js activity more closely. The then ran the actual payload: lib/Math_Symbol.js, an obfuscated, self-propagating credential-stealing worm.

What It Steals #

The payload went after every credential a developer is likely to have on their machine: npm auth tokens, GitHub tokens, AWS access keys, HashiCorp Vault secrets, Kubernetes configs, SSH keys, Terraform state files, Docker registry credentials, CI/CD environment variables, .env files, and cryptocurrency wallets. It also specifically targeted AI developer tool configurations: .claude, .cursor, Kiro, Windsurf, and Zed config files.

That last category is what makes this attack particularly aimed at the AI development community. Tensorlake is a serverless sandbox platform for AI agents — its npm SDK is used by people building agentic applications. Those developers tend to have the richest credential profiles: cloud infrastructure access plus active AI API keys, all on the same workstation.

The Dead-Man Switch #

After exfiltrating credentials, the worm installs a background service called gh-token-monitor. Every 60 seconds, for up to 24 hours, this service checks the stolen GitHub token against the GitHub API. If it detects the token has been revoked, it executes rm -rf ~/ — deleting your entire home directory.

This is not a hypothetical. StepSecurity confirmed the dead-man switch mechanism in their analysis. The order of remediation matters critically. Do not revoke any tokens until you have removed the monitor.

What to Do If You Installed 0.5.144 #

First, check whether you are affected:

npm ls tensorlake

If you see version 0.5.144 in the output or in your package-lock.json, follow this order exactly.

Step 1 — Remove the monitor first:

rm -rf ~/.config/gh-token-monitor \
  ~/.local/bin/gh-token-monitor.sh \
  ~/Library/LaunchAgents/com.user.gh-token-monitor.plist

Step 2 — Then rotate every credential the worm could reach: GitHub tokens, npm tokens, AWS keys, Kubernetes credentials, SSH keys, HashiCorp Vault secrets, AI tool API keys, and anything in .env files. If you use a browser-synced password manager, audit it as well.

The safe version is 0.5.143. Tensorlake reverted the compromise in PR #1016 and has since hardened its npm release path.

This Is Not a One-Off #

The Shai-Hulud malware family has been active throughout 2026. In August, the same worm hit keyv — a caching library with hundreds of millions of weekly npm downloads — and spread to over 1,300 dependent packages including cacheable, flat-cache, and file-entry-cache. In June, the Mastra AI framework had 140+ packages backdoored via a typosquatting dependency. The attack pattern is consistent: compromise a maintainer account, push to main, use the legitimate CI/CD pipeline to publish, let Sigstore provenance create false confidence.

Provenance proves the build was built correctly. It does not prove the source code was clean. Chainguard’s analysis of the keyv campaign lays this out clearly: the attacker used the legitimate pipeline as a weapon. That distinction is the entire exploit.

Hardening Your npm Workflow #

• Pin exact versions inpackage-lock.json . Avoid^ and~ ranges for critical dependencies.
• Audit preinstall scripts before runningnpm install . Usenpm install --ignore-scripts to inspect a package before executing its hooks.
• Use Socket (socket.dev ) or a similar real-time supply chain monitor. Eleven minutes is better than nothing; zero minutes is the goal.
• Enable branch protection on your repos . Require PR reviews and disable direct pushes to main.
• Use short-lived OIDC tokens for CI/CD . Long-lived npm publish tokens are exactly what this worm is designed to harvest and reuse.

The attack surface for AI developers is expanding faster than security practices are evolving. Tensorlake will not be the last AI agent platform targeted this way.