Cybersecurity

Tensorlake npm package carries Shai-Hulud worm

Security researchers said a compromised version of the Tensorlake npm package shipped a credential-stealing, self-propagating worm, and StepSecurity said the release was published from the project’s own repository.

The Hacker News 08 October 2026

Socket said version 0.5.144 of the tensorlake npm package had been compromised and was no longer available from the npm registry.
Socket said the release contained a preinstall hook and an obfuscated loader that launched a credential-stealing, self-propagating worm.
StepSecurity said malicious files were pushed to the main branch of tensorlakeai/tensorlake under a maintainer’s name, and the package was then published from that repository.
The malware used an Ethereum contract to find its command-and-control endpoint and used GitHub as a fallback place to stage stolen data.
Users who had installed the malicious version were told to remove it and rotate their credentials.

Socket said the npm package tensorlake had been compromised in version 0.5.144 as part of a ChainDrop and Shai-Hulud supply-chain attack. The package was a TypeScript SDK for Tensorlake applications, sandboxes and cloud services, and the malicious version had been removed from the registry.

Socket’s analysis said the release used a preinstall hook to start a JavaScript file, which then loaded the main worm through the Bun runtime. It said the code was built to steal credentials, spread itself, keep access on the host and run code supplied by an attacker.

The malware was reported to search local files, CI systems, Kubernetes and Vault sources for secrets. It also dropped the HackBrowserData binary and collected npm tokens, GitHub tokens, AWS credentials, HashiCorp Vault data, Kubernetes credentials, SSH keys, .env files, cryptocurrency wallets, messaging app data, and configuration files for Anthropic Claude, Cursor, Kiro, Windsurf and Zed.

Socket said the worm enumerated packages tied to the victim’s publishing identity, built Sigstore provenance and republished compromised versions. It also said the code used GitHub Actions-style workflows and used an Ethereum contract to discover its command-and-control server at iseekaigogo[.]com, with GitHub used as a fallback to hold encrypted stolen data.

StepSecurity said the malicious files were pushed to the main branch of tensorlakeai/tensorlake under a maintainer’s name, and that the first rogue commit was made on 7 October 2026 at 01:20 UTC. It said the repository’s release workflow published version 0.5.144 the next day, and that the malware wrote .claude/settings.json and .vscode/tasks.json so it could run again in Claude Code or VS Code.

Named in this story

People

Ashish Kurmi: a StepSecurity researcher who described the persistence files

Companies

Socket: analysed the release and described the malicious code
StepSecurity: said the malicious files were pushed to the repository and the package was released from it
GitHub: served as a fallback place to stage stolen data and host workflow files

Products and systems

tensorlake: the npm package that was compromised
Shai-Hulud: the worm and supply-chain malware family delivered through the package
HackBrowserData: the binary the malware dropped to collect browser data
tensorlakeai/tensorlake: the repository from which the rogue release was published
Sigstore: the provenance system the worm used when republishing compromised packages

How the source tells it

The piece was mainly a technical incident report, with a brief urgent warning at the end.

urgency ends with immediate-removal guidance and credential-rotation advice