Shai-Hulud reaches the Tensorlake npm SDK, with a wiper that fires when you revoke the stolen token

The npm SDK for Tensorlake, a platform for running AI agents and untrusted AI-written code in sandboxes, shipped a credential-stealing worm in version 0.5.144. According to StepSecurity, the first malicious commit landed directly on the main branch of tensorlakeai/tensorlake at 01:20 UTC on October 7 under a maintainer's name, and the repository's own release workflow published the package at 01:12 UTC on October 8, so it carried valid provenance. Socket flagged it 11 minutes later. A preinstall hook runs a Bun-based payload, linked by researchers to the ChainDrop variant of Shai-Hulud, that takes npm, GitHub, AWS, Kubernetes and HashiCorp Vault credentials, SSH keys, .env files and AI tool configs, then republishes the victim's other packages. Tensorlake released 0.5.145; how the attacker got the maintainer's access is not public.

Why it matters

Provenance did its job and still did not help: it proved the package came from the real repository's workflow, and the attacker was inside that repository. What failed was the identity allowed to push to main without review, and a release pipeline that trusts whatever is on main. Branch protection on release branches, and treating maintainer push rights as a publishing credential, are the controls to check.

The incident response order also changes. If a GitHub token was stolen, the malware installs a gh-token-monitor service that checks it every 60 seconds and, per StepSecurity, deletes the home directory once it is revoked. Remove that persistence first, then rotate npm, cloud, Vault and SSH credentials, and rebuild hosts that ran the install. The skip-on-CI check means developer laptops are the main target. See secrets in repositories and CI and our coverage of the Shai-Hulud variant that hunts 469 credential locations. Coverage from The Register adds that the SDK sees about 12,000 weekly downloads.

Source: The Hacker News