Tensorlake npm Package Compromised to Deliver Shai-Hulud Credential-Stealing Worm

1. Executive summary

The npm package tensorlake, a TypeScript SDK for Tensorlake applications, sandboxes and cloud services, was published in a malicious version 0.5.144 as part of the ChainDrop / Shai-Hulud supply chain campaign. The release carries a preinstall hook that runs package/lib/setup.mjs, an obfuscated loader that launches the credential-stealing and self-propagating worm package/lib/Math_Symbol.js under the Bun runtime. The payload harvests npm, GitHub, AWS, HashiCorp Vault, Kubernetes and SSH credentials, drops the HackBrowserData binary, establishes host persistence, and can execute remotely supplied code, so any secret reachable by the installing process should be treated as exposed. The verified reference data records no CVSS score, no CISA KEV entry and no EPSS value for this item, and the actor "Shai-Hulud" has no MITRE ATT&CK profile, so the attribution is unconfirmed. EMEA financial services exposure runs through developer workstations and CI/CD runners that installed the package with lifecycle scripts enabled, and through the downstream build artefacts those runners produced.

2. Regulatory framing

No DORA Art. 17, 18, 19, 24 or 29 row is included: the source material does not establish that a major ICT-related incident has occurred at any named client, and the item does not describe a testing programme or a concentration-risk assessment. UK NIS 2018 duties are not engaged on the facts available, since the source does not identify an OES or RDSP as affected.

3. Technical analysis & attack chain

Confirmed steps, in order:

1. A maintainer account for tensorlakeai/tensorlake was used to push malicious files to the main branch. The first rogue commit is recorded at 2026-10-07 01:20 UTC.
2. The repository's own release workflow published version 0.5.144 to npm the following day, with an npm provenance attestation. The malicious release was built from the project's main branch, so the attestation reflects a genuine build of a poisoned tree.
3. On install, the preinstall lifecycle hook in package.json runs before installation completes. It launches package/lib/setup.mjs.
4. setup.mjs is an obfuscated loader. It checks whether the Bun JavaScript runtime is present; if not, it detects platform and architecture, downloads Bun v1.3.13 from the official release page, extracts it, and uses it to execute the payload. The Bun temporary directory is deleted afterwards.
5. The payload is package/lib/Math_Symbol.js, roughly 711 KB, obfuscated with control-flow flattening and a Base91 string encoding scheme. It carries Dune-themed strings (laza, kanly, ghola, mentat, lasgun, sietch, fedaykin, tleilaxu, sandworm, sardaukar, ornithopter, navigator).
6. A collector component scans over 300 credential patterns across local files, CI environments, Kubernetes and Vault sources. Targeted material includes npm tokens, GitHub tokens (PATs, JWTs, session tokens), AWS credentials and secrets, HashiCorp Vault tokens, Kubernetes service account tokens, SSH private keys, .env files, cryptocurrency wallets, messaging app data, and configuration and MCP files for Anthropic Claude, Cursor, Kiro, Windsurf and Zed. AI tooling credentials named in the source include Anthropic, Claude, Codex, Cursor, OpenAI and Gemini; cloud credentials named include AWS, GCP, Azure and Alibaba Cloud.
7. Stolen data is gzip-compressed, encrypted with a randomly generated AES-256-GCM key, and that key is RSA-encrypted with the attacker's hardcoded key. Exfiltration goes to an attacker-controlled HTTPS endpoint resolved through an Ethereum contract for the domain iseekaigogo[.]com, with GitHub as a fallback channel staging encrypted data in a public repository described as "Shai-Hulud: Here We Go Again".
8. The malware drops the HackBrowserData binary, establishes persistence on the host, and can execute remotely supplied code.
9. Propagation: with a stolen npm publishing token, the worm enumerates packages available to the victim identity, downloads their latest tarballs, inserts the malware and setup loader, adds a preinstall hook, increments the patch version, builds Sigstore provenance, and republishes. Strings referencing a fake Copilot/Dependabot workflow suggest it also plants GitHub Actions workflows.
10. Second propagation path: with stolen GitHub credentials, it queries the GitHub API for accessible repositories and branches and commits malicious configuration directly. Where a GitHub App token is available, it commits hooks to up to 50 branches per accessible repository, injecting .claude/settings.json and .vscode/tasks.json into each. Opening the repository in Claude Code triggers a SessionStart hook running node .claude/setup.mjs; opening it in VS Code triggers a folderOpen task running node .vscode/setup.mjs. Infection then occurs without any npm install.
11. Worm-generated commits are identifiable by author name claude and commit message chore: update config.

The "hostage token" component is the most consequential capability for incident response. A PowerShell monitor repeatedly polls api.github.com/user with the stolen GitHub token to check validity. If the victim revokes the token, the monitor runs an attacker-supplied handler through the Invoke-Expression cmdlet to execute PowerShell code intended to trigger a destructive routine. The source describes this as likely destructive and notes the tactic appeared in earlier Shai-Hulud waves; the exact destructive action is not specified in the material available. Revoking a stolen GitHub token without first isolating the host can therefore trigger destructive execution.

Two filename variants are documented for the payload across the campaign: Math_Symbol.js in packages compromised directly from a maintainer monorepo, and math_init.js in packages trojanized during worm propagation. Both share the same SHA-256 hash, so the filename indicates the infection generation. The tensorlake 0.5.144 release uses Math_Symbol.js, consistent with direct compromise of the maintainer's repository.

Confidence caveats. The tensorlake-specific detail (version 0.5.144, the package/lib/setup.mjs and package/lib/Math_Symbol.js paths, the commit timestamp, the HackBrowserData drop, the Ethereum-based C2 resolution) rests primarily on Socket analysis reported by The Hacker News and on StepSecurity, with the commit and provenance detail single-sourced to StepSecurity. The broader campaign mechanics (400+ packages, the keyv monorepo, the Bun v1.3.13 download, the 711 KB payload, the Dune strings, the collector pattern count, the AES-256-GCM and RSA encryption scheme, the 50-branch GitHub App propagation) are corroborated across Microsoft Threat Intelligence and Elastic Security Labs. The actor name "Shai-Hulud" has no MITRE ATT&CK profile in the verified reference data; attribution to a tracked group is unconfirmed and Adverse Trace does not make one.

4. Mitigation & containment

P1, within 24 hours:

• Identify every workstation, build runner and container image that installed tensorlake 0.5.144. Check lockfiles (package-lock.json, yarn.lock, pnpm-lock.yaml) and CI logs for the version string. Version 0.5.144 has been removed from the npm registry, so it will not resolve on a fresh install, but cached tarballs and existing lockfiles will still reference it.
• Isolate any host that installed the package with lifecycle scripts enabled. Treat the workstation or build runner as compromised. Do not revoke stolen GitHub tokens before isolation: the hostage-token monitor polls api.github.com/user and runs an attacker handler through Invoke-Expression on revocation, which the source describes as likely destructive.
• Search all branches, not only main, for .claude/settings.json and .vscode/tasks.json files that were not added by your own developers. Check for a SessionStart hook in the Claude settings file and a folderOpen task in the VS Code tasks file.
• Search repositories for commits authored by claude with the message chore: update config, and for unexpected preinstall entries in package.json.
• Block or alert on outbound resolution and connections to iseekaigogo[.]com.
• Rotate, from a known-clean environment, every credential reachable by the affected identity: npm publishing tokens, GitHub PATs and App tokens, AWS keys, HashiCorp Vault tokens, Kubernetes service account tokens, SSH private keys, and .env contents. Rotate AI tooling credentials for Anthropic, Claude, Codex, Cursor, OpenAI and Gemini, and cloud credentials for AWS, GCP, Azure and Alibaba Cloud.

P2, within 72 hours:

• Rebuild affected systems and downstream artefacts from trusted sources. Any artefact produced by a compromised build runner should be considered tainted.
• Audit npm for unauthorised releases under your publishing identities, and audit GitHub for unexpected repository or workflow modifications, including planted Copilot/Dependabot workflow files.
• Review cloud and secret-store access logs for enumeration activity consistent with the collector component: package listing, repository listing, workflow secret reads, cloud parameter reads, and secret-store value reads.
• Disable npm lifecycle scripts by default in developer and CI environments where the build does not require them (npm install --ignore-scripts), and re-enable only for packages that need them.

P3, within 7 days:

• Evaluate whether GitHub Actions trusted publishing and OIDC publishing access are appropriate for your repositories, given that the campaign used stolen publishing tokens and, in targeted workflows, GitHub Actions OIDC publishing access.
• Pin dependencies to known-good versions and verify against the SafeDep list of compromised packages and versions referenced by The Register.
• Review whether provenance attestation is being treated as a trust signal in your supply chain controls. In this incident the malicious release carried a valid provenance attestation.

5. Indicators of compromise

No file hashes are included. The sources reference a shared SHA-256 hash for the payload variants but do not reproduce the value, so none is available to publish.

package  tensorlake 0.5.144
filepath  package/lib/setup.mjs
filepath  package/lib/Math_Symbol.js
filepath  .claude/settings.json
filepath  .vscode/tasks.json
domain  iseekaigogo[.]com
commit_author  claude
commit_message  chore: update config
repo_description  Shai-Hulud: Here We Go Again

Behavioural indicators:

6. Detection

rule npm_ShaiHulud_ChainDrop_Tensorlake_Loader
{
    meta:
        author = "Adverse Trace"
        date = "2026-10-08"
        reference = "https://thehackernews.com/2026/10/tensorlake-npm-package-compromised-to.html"
        description = "Detects the Shai-Hulud / ChainDrop npm loader and payload artefacts associated with the tensorlake 0.5.144 compromise"
    strings:
        $s1 = "package/lib/setup.mjs" ascii
        $s2 = "package/lib/Math_Symbol.js" ascii
        $s3 = "Math_Symbol.js" ascii
        $s4 = "math_init.js" ascii
        $s5 = ".claude/settings.json" ascii
        $s6 = ".vscode/tasks.json" ascii
        $s7 = "chore: update config" ascii
        $s8 = "Shai-Hulud: Here We Go Again" ascii
        $s9 = "iseekaigogo" ascii
        $s10 = "laza" ascii
        $s11 = "kanly" ascii
        $s12 = "ghola" ascii
        $s13 = "mentat" ascii
        $s14 = "lasgun" ascii
        $s15 = "sietch" ascii
        $s16 = "fedaykin" ascii
        $s17 = "tleilaxu" ascii
        $s18 = "sandworm" ascii
        $s19 = "sardaukar" ascii
        $s20 = "ornithopter" ascii
        $s21 = "navigator" ascii
    condition:
        uint32(0) == 0x04034b50 and 4 of them
}

The Dune-themed strings are short and individually prone to false positives; the condition requires at least four matches inside a ZIP archive (npm tarballs are ZIP containers), which keeps the rule anchored to the payload bundle rather than to unrelated files.

title: Shai-Hulud ChainDrop npm preinstall loader execution
id: 7f3c1a92-4b6e-4d21-9c8a-2e5f0a1b6d34
status: experimental
description: Detects execution of the Shai-Hulud / ChainDrop npm preinstall loader and its Claude Code and VS Code persistence hooks
author: Adverse Trace
date: 2026-10-08
references:

    - https://thehackernews.com/2026/10/tensorlake-npm-package-compromised-to.html
    - https://www.elastic.co/security-labs/shai-hulud-chaindrop-npm-supply-chain
logsource:
    category: process_creation
    product: linux
detection:
    selection_loader:
        CommandLine|contains:

            - 'setup.mjs'
            - 'Math_Symbol.js'
            - 'math_init.js'
    selection_hooks:
        CommandLine|contains:

            - '.claude/setup.mjs'
            - '.vscode/setup.mjs'
    selection_bun:
        Image|endswith:

            - '/bun'
        CommandLine|contains:

            - 'Math_Symbol.js'
            - 'math_init.js'
    condition: selection_loader or selection_hooks or selection_bun
falsepositives:

    - Legitimate packages that ship a setup.mjs loader; validate against the tensorlake 0.5.144 package and the campaign file list before alerting
level: high

title: Shai-Hulud ChainDrop hostage token monitor polling GitHub user API
id: 2a8d5e14-9c37-4f60-b1d2-6e4a7c0f9b58
status: experimental
description: Detects PowerShell repeatedly polling api.github.com/user, the hostage-token validity check used by Shai-Hulud variants before triggering a destructive handler on token revocation
author: Adverse Trace
date: 2026-10-08
references:

    - https://thehackernews.com/2026/10/tensorlake-npm-package-compromised-to.html
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:

            - '\powershell.exe'
            - '\pwsh.exe'
        CommandLine|contains:

            - 'api.github.com/user'
            - 'Invoke-Expression'
    condition: selection
falsepositives:

    - Administrative scripts that query the GitHub API; correlate with repeated polling and with the presence of the Shai-Hulud loader artefacts
level: high

7. Sources

• The Hacker News, "Tensorlake npm Package Compromised to Deliver Shai-Hulud Credential-Stealing Worm", https://thehackernews.com/2026/10/tensorlake-npm-package-compromised-to.html, 2026-10-08
• Step Security, "Tensorlake npm Package Compromised: A Worm With a Hostage Token That Wipes Your Machine If You Revoke It", https://www.stepsecurity.io/blog/tensorlake-npm-compromised-hostage-token-worm
• Microsoft Threat Intelligence, "ChainDrop supply chain compromise: Anatomy of a self-propagating worm", https://www.microsoft.com/en-us/security/blog/2026/08/04/chaindrop-supply-chain-compromise-anatomy-self-propagating-worm/, 2026-08-04
• Elastic Security Labs, "Shai-Hulud strikes again: CHAINDROP worm hits 400+ npm packages", https://www.elastic.co/security-labs/threat-command/shai-hulud-chaindrop-npm-supply-chain
• Elastic Security Labs, "Shai-Hulud strikes again: CHAINDROP worm hits 400+ npm packages", https://www.elastic.co/security-labs/shai-hulud-chaindrop-npm-supply-chain
• Cybersecurity Dive, "Dozens of Red Hat npm packages targeted in supply-chain attack", https://www.cybersecuritydive.com/news/dozens-red-hat-npm-packages-supply-chain-attack/821723/
• The Register, "ChainDrop worm crawls into npm supply chain, evades standard defenses", https://www.theregister.com/security/2026/08/15/chaindrop-worm-crawls-into-npm-supply-chain-evades-standard-defenses/5287958, 2026-08-15

8. Adverse Trace position

Adverse Trace assesses this as a high-impact supply chain compromise with a contained blast radius per victim but severe consequences where it lands. The verified reference data records no CVSS score, no CISA KEV entry and no EPSS value for this item, and "Shai-Hulud" has no MITRE ATT&CK profile, so we do not assign a group attribution and we do not treat the actor as tracked. The tensorlake-specific detail is single-sourced to Socket via The Hacker News and to StepSecurity; the campaign mechanics are corroborated across Microsoft and Elastic. Clients should verify the tensorlake 0.5.144 indicators against their own lockfiles before acting on enforcement, and should not revoke stolen GitHub tokens until affected hosts are isolated, given the hostage-token behaviour. We will track further tensorlake version disclosures, any expansion of the compromised package list, and any confirmed destructive execution tied to the hostage-token handler, and will issue a follow-up if the campaign reaches packages in use across EMEA financial services build pipelines.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.