# Shai-Hulud reaches the Tensorlake npm SDK, with a wiper that fires when you revoke the stolen token

Source: https://startwithidentity.com/blog/2026-10-08-shai-hulud-reaches-tensorlake-npm-sdk-with-a-token-revocation-wiper/
Last updated: 2026-10-08
License: content by Start with Identity. Cite the source URL.

---

The npm SDK for Tensorlake, a platform for running AI agents and untrusted AI-written code in sandboxes, shipped a credential-stealing worm in version 0.5.144. According to StepSecurity, the first malicious commit landed directly on the `main` branch of `tensorlakeai/tensorlake` at 01:20 UTC on October 7 under a maintainer's name, and the repository's own release workflow published the package at 01:12 UTC on October 8, so it carried valid provenance. Socket flagged it 11 minutes later. A `preinstall` hook runs a Bun-based payload, linked by researchers to the ChainDrop variant of Shai-Hulud, that takes npm, GitHub, AWS, Kubernetes and [HashiCorp Vault](https://startwithidentity.com/vendors/machine-identity/hashicorp-vault/) credentials, SSH keys, `.env` files and AI tool configs, then republishes the victim's other packages. Tensorlake released 0.5.145; how the attacker got the maintainer's access is not public.

## Why it matters

Provenance did its job and still did not help: it proved the package came from the real repository's workflow, and the attacker was inside that repository. What failed was the identity allowed to push to `main` without review, and a release pipeline that trusts whatever is on `main`. Branch protection on release branches, and treating maintainer push rights as a publishing credential, are the controls to check.

The incident response order also changes. If a GitHub token was stolen, the malware installs a `gh-token-monitor` service that checks it every 60 seconds and, per StepSecurity, deletes the home directory once it is revoked. Remove that persistence first, then rotate npm, cloud, Vault and SSH credentials, and rebuild hosts that ran the install. The skip-on-CI check means developer laptops are the main target. See [secrets in repositories and CI](https://startwithidentity.com/techniques/secrets-in-repositories-and-ci/) and our coverage of the [Shai-Hulud variant that hunts 469 credential locations](https://startwithidentity.com/blog/2026-09-03-shai-hulud-worm-now-hunts-469-credential-locations/). Coverage from [The Register](https://www.theregister.com/security/2026/10/08/shai-hulud-worm-makes-jump-to-ai-infrastructure-with-tensorlake-compromise/5302054) adds that the SDK sees about 12,000 weekly downloads.

Source: [The Hacker News](https://thehackernews.com/2026/10/tensorlake-npm-package-compromised-to.html)