Tensorlake npm Package Compromised: A Worm With a Hostage Token That Wipes Your Machine If You Revoke It

1. Executive summary

The npm package tensorlake, a TypeScript SDK for Tensorlake applications, sandboxes and cloud services, was compromised at version 0.5.144. The malicious release was built from the project's own main branch and carries a valid npm provenance attestation, so provenance alone does not mark it as safe. Installing the package runs a preinstall hook that downloads the Bun runtime, executes an obfuscated 856 KB payload, harvests GitHub and npm tokens, cloud keys, Kubernetes and Vault secrets, SSH keys, saved browser logins and AI-tool configuration, then republishes the victim's own npm packages and commits to their GitHub repositories. The payload also installs a persistent service, gh-token-monitor, that deletes the user's home directory if the stolen GitHub token is revoked within 24 hours, which inverts the normal incident response order: revoking the token first triggers destructive action. No CVE is assigned and no CISA KEV entry exists for this item. EMEA financial services exposure is limited to engineering and platform teams that build or run Tensorlake SDKs in developer environments, but the credential set the worm targets (cloud keys, Kubernetes and Vault secrets, SSH keys) is exactly the material that grants access to production estates, so a single developer workstation compromise can escalate to infrastructure access.

2. Regulatory framing

No DORA Art. 18, 19, 24, 29 or 30, NIS2 Art. 23, or UK NIS 2018 obligation is directly engaged by the facts in this item as supplied.

3. Technical analysis & attack chain

Confirmed steps, in order:

1. The first malicious commit landed on the main branch of tensorlakeai/tensorlake at 01:20 UTC on 7 October 2026, authored under a maintainer's name. Seven further commits followed over the next few hours, modifying the payload and adding a preinstall line to package.json. None of the commits went through a pull request.
2. At 01:12 UTC on 8 October 2026, the repository's release workflow published version 0.5.144 to npm, started under the same maintainer identity. The files in the npm package are identical to the files on main.
3. On install, the preinstall hook runs setup.mjs. The script skips execution on CI systems, so developer workstations are the target.
4. setup.mjs downloads the Bun runtime and uses it to execute an obfuscated 856 KB payload. StepSecurity decoded the file without executing it.
5. The payload harvests GitHub and npm tokens, cloud keys, Kubernetes and Vault secrets, SSH keys, saved browser logins, and configuration files for AI tools including Claude, Cursor and Windsurf.
6. Harvested data is encrypted and exfiltrated either to a public GitHub repository the malware creates in the victim's own account (repository description "Shai-Hulud: Here We Go Again") or to iseekaigogo.com.
7. With a stolen npm token, the worm downloads the victim's packages, adds itself, bumps the version and republishes them. With a stolen GitHub token, it commits .claude/settings.json and .vscode/tasks.json into the victim's repositories under the author claude@users.noreply.github.com with the commit message "chore: update dependencies".
8. When a GitHub token is present, the payload installs a service named gh-token-monitor. Every 60 seconds for up to 24 hours it checks the token against the GitHub API. If GitHub rejects the token, the service runs rm -rf ~/ on Linux or a PowerShell deletion of the user profile on Windows.

The persistence mechanism is twofold. The gh-token-monitor service is the destructive component and runs from the user's own session. Separately, the .claude/settings.json and .vscode/tasks.json files written into reachable repositories cause the payload to run again when a developer opens the project in Claude Code or VS Code, which moves execution from the original host to any machine that clones the repository.

Impacted artefacts:

• npm: tensorlake@0.5.144
• GitHub: tensorlakeai/tensorlake main branch, commits e90c47b to 6386121. The payload sits under typescript/lib/.
• At the time of StepSecurity's report, 0.5.144 could still be downloaded from npm.

The provenance attestation on 0.5.144 is genuine and records where the package was built. It does not attest that the code is safe, and in this case the malicious release was built from the project's own main branch, so the attestation validates a compromised build rather than catching it.

Attribution and confidence. The Hacker News describes the compromise as part of a ChainDrop / Shai-Hulud supply chain attack, and the exfiltration repository description references Shai-Hulud. No MITRE ATT&CK profile for a named actor is present in the verified reference data for this item, so the attribution to Shai-Hulud is unconfirmed at actor level. The technical detail above rests primarily on a single source, StepSecurity's analysis, with The Hacker News corroborating the package name, version and general capability set. Treat the specific file paths, service names and command lines as single-sourced until independently verified.

4. Mitigation & containment

P1, within 24 hours. Do not revoke any GitHub token on a host that may have installed 0.5.144 until the gh-token-monitor service has been removed. This is the single most important step and it runs against normal incident response instinct.

• Determine exposure. Run npm ls tensorlake and search lockfiles for 0.5.144. Check whether any developer cloned or pulled tensorlakeai/tensorlake main since 7 October 2026 and ran npm install inside typescript/.
• On any host where 0.5.144 was installed, check for the folder ~/.config/gh-token-monitor/. If present, open the token file inside to identify which GitHub token it holds, then stop the service before doing anything else.
• Linux: systemctl --user disable --now gh-token-monitor.service, then rm -rf ~/.config/gh-token-monitor ~/.local/bin/gh-token-monitor.sh ~/.config/systemd/user/gh-token-monitor.service.
• macOS: launchctl bootout gui/$(id -u) ~/Library/LaunchAgents/com.user.gh-token-monitor.plist, then remove the gh-token-monitor directory and plist.
• Back up anything that cannot be lost before touching the service, because the deletion trigger is live until the service is stopped.

P2, within 72 hours.

• Pin tensorlake to 0.5.143. Delete node_modules and run npm cache clean --force.
• Set ignore-scripts=true in .npmrc to stop install hooks of this class from running. This is a blunt control and will break packages that legitimately need install scripts, so scope it to repositories that do not require them.
• Rotate every credential the payload targets on affected hosts: GitHub tokens, npm tokens, cloud provider keys, Kubernetes and Vault secrets, SSH keys, and saved browser credentials. Rotate only after the token monitor is confirmed removed.
• Search the organisation's GitHub repositories for commits authored by claude@users.noreply.github.com with the message "chore: update dependencies", and for added .claude/settings.json or .vscode/tasks.json files. Remove them and treat any repository that received them as compromised.
• Check the organisation's npm scope for packages republished by the worm and unpublish or revert them.

P3, within 7 days.

• Add detection for the preinstall execution of setup.mjs and for Bun runtime downloads on developer endpoints.
• Review whether provenance attestation is being treated as a trust signal in the dependency approval process, and correct that assumption in policy.
• Block or alert on iseekaigogo.com at the DNS and proxy layer.

5. Indicators of compromise

package  tensorlake@0.5.144
package  tensorlake@0.5.143
file  typescript/lib/
file  ~/.config/gh-token-monitor/
file  ~/.local/bin/gh-token-monitor.sh
file  ~/.config/systemd/user/gh-token-monitor.service
file  ~/Library/LaunchAgents/com.user.gh-token-monitor.plist
file  .claude/settings.json
file  .vscode/tasks.json
service  gh-token-monitor.service
domain  iseekaigogo[.]com
commit  e90c47b to 6386121
email  claude@users.noreply.github.com
string  chore: update dependencies

No file hashes are available in the source material.

Behavioural indicators:

6. Detection

rule npm_tensorlake_shai_hulud_hostage_token
{
    meta:
        author = "Adverse Trace"
        date = "2026-10-08"
        reference = "https://www.stepsecurity.io/blog/tensorlake-npm-compromised-hostage-token-worm"
        description = "Detects artefacts of the tensorlake@0.5.144 supply chain payload, including the gh-token-monitor hostage service and the repository persistence files"
    strings:
        $s1 = "gh-token-monitor" ascii wide
        $s2 = "Shai-Hulud: Here We Go Again" ascii wide
        $s3 = "iseekaigogo.com" ascii wide
        $s4 = "chore: update dependencies" ascii wide
        $s5 = "claude@users.noreply.github.com" ascii wide
        $s6 = "setup.mjs" ascii wide
        $s7 = ".claude/settings.json" ascii wide
        $s8 = ".vscode/tasks.json" ascii wide
        $s9 = "rm -rf ~/" ascii wide
    condition:
        uint32(0) == 0x04034b50 or 3 of them
}

title: Tensorlake npm preinstall hook execution and hostage token service
id: 7f3c1a92-4b6e-4d21-9c88-2a5e0f1b7d34
status: experimental
description: Detects execution of the tensorlake@0.5.144 preinstall payload via the Bun runtime and creation of the gh-token-monitor persistence service
author: Adverse Trace
date: 2026-10-08
references:

    - https://www.stepsecurity.io/blog/tensorlake-npm-compromised-hostage-token-worm
logsource:
    category: process_creation
    product: linux
detection:
    selection_setup:
        CommandLine|contains:

            - 'setup.mjs'
            - 'bun run'
    selection_monitor:
        CommandLine|contains:

            - 'gh-token-monitor'
            - 'gh-token-monitor.sh'
    selection_delete:
        CommandLine|contains:

            - 'rm -rf ~/'
    condition: selection_setup or selection_monitor or selection_delete
falsepositives:

    - Legitimate Bun usage in development environments
    - Administrative scripts that remove home directory contents
level: high

title: Tensorlake worm repository persistence files committed to GitHub
id: 9c1d5e77-2a48-4f60-b3d1-6e8a4c0f2b19
status: experimental
description: Detects commits adding .claude/settings.json or .vscode/tasks.json under the fake author used by the tensorlake worm
author: Adverse Trace
date: 2026-10-08
references:

    - https://www.stepsecurity.io/blog/tensorlake-npm-compromised-hostage-token-worm
logsource:
    product: github
    service: audit
detection:
    selection_author:
        actor: 'claude@users.noreply.github.com'
    selection_message:
        commit_message: 'chore: update dependencies'
    selection_files:
        files_added|contains:

            - '.claude/settings.json'
            - '.vscode/tasks.json'
    condition: selection_author or (selection_message and selection_files)
falsepositives:

    - Automated dependency update bots using a similar commit message
level: high

7. Sources

• StepSecurity, "Tensorlake npm Package Compromised: A Worm With a Hostage Token That Wipes Your Machine If You Revoke It", https://www.stepsecurity.io/blog/tensorlake-npm-compromised-hostage-token-worm, 2026-10-08.
• The Hacker News, "Tensorlake npm Package Compromised to Deliver Shai-Hulud Credential-Stealing Worm", https://thehackernews.com/2026/10/tensorlake-npm-package-compromised-to.html, 2026-10-08.

8. Adverse Trace position

Adverse Trace assesses this as a high-impact supply chain compromise with a destructive anti-remediation mechanism, and the operational risk sits in the response order rather than in the payload's stealth. No CVE is assigned and there is no CISA KEV entry, so severity here is driven by the credential set the worm harvests and by the fact that the standard first response, revoking the stolen GitHub token, triggers deletion of the user's home directory. The technical detail is single-sourced to StepSecurity with The Hacker News corroborating the package and capability set, so we treat the file paths, service names and command lines as reliable but not independently confirmed; verify before enforcing blocks on them. Attribution to Shai-Hulud is unconfirmed: no MITRE ATT&CK profile for a named actor appears in the verified reference data for this item. We will monitor for additional victim reports, for any revision to the impacted commit range or version list, and for confirmation of the exfiltration domain from a second source, and we will reissue this advisory if the indicator set changes. Clients running Tensorlake SDKs in developer environments should treat the P1 service removal step as the first action, ahead of credential rotation.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.