Malicious Tensorlake npm Version Exfiltrated Tokens, Secrets, and Cloud Creds

Tensorlake npm package—the TypeScript SDK for Tensorlake (an AI agent infrastructure platform).

 

The package was injected with a variant of the Shai-H​ulud (ChainDrop) worm, which steals developer credentials, self-propagates through the victim's repositories, and deploys a destructive "hostage token" dead-man's switch.

The attack bypassed traditional perimeter checks by leveraging compromised credentials from an internal project maintainer:

Verified Commits: On October 7, 2026, the threat actor made direct file uploads to the main branch of the tensorlakeai/tensorlake GitHub repository using a maintainer’s verified identity, entirely bypassing the pull request process.

Valid Provenance Attestation: Because the malicious code lived directly on the main branch, the repository's automated GitHub Actions pipeline legitimately built and published the package. Consequently, version 0.5.144 shipped with a valid npm provenance attestation, proving that security frameworks relying solely on build-origin verification can still let malicious code through.

Malware Behavior

When a developer installs the compromised package, the malware targets local environments rather than CI/CD pipelines:

The Loader: A preinstall hook in package.json triggers an obfuscated script (setup.mjs). This script automatically downloads the Bun runtime to execute the main, heavily obfuscated 856 KB malware payload (Math_Symbol.js).

Mass Data Theft: The malware harvests local environment variables, cloud keys (AWS), Kubernetes/Vault secrets, SSH keys, and AI tool configurations (for Claude, Cursor, and Windsurf).

Targeting Crypto Wallets: Differing from previous Shai-Hulud waves, this variant heavily targets developer endpoints for fast monetization by extracting local IndexedDB and LevelDB files from 14 different cryptocurrency browser extensions. It also fetches a remote HackBrowserData binary to scrape general browser credentials and cookies.

Blockchain-Based C2: While hardcoding the command-and-control (C2) server iseekaigogo[.]com, the worm also features a "dead-drop" backup mechanism. It queries a specific Ethereum smart contract to resolve alternative exfiltration domains if the primary C2 is blocked.

 Worm (Self-Spreading)

Once inside a system, the malware attempts to infect connected developer infrastructure:

npm Ecosystem: Using stolen npm tokens, the worm automatically downloads the victim’s own published packages, injects its malicious payload, bumps the version, and republishes them under the victim's name.

IDE Backdoors: Using stolen GitHub tokens, it commits hidden .claude/settings.json and .vscode/tasks.json files to any reachable repository. This ensures that the malware executes again as a background task the moment anyone opens those projects in VS Code or Claude Code.

 The "Hostage Token" Dead-Man's Switch

The most critical mechanism identified by security researchers at StepSecurity is a trap designed to penalize remediation:

If the malware successfully steals a GitHub token, it installs a background local service called gh-token-monitor.

This service pings the GitHub API every 60 seconds to check if the token is still active.

The Trap: If a security team or developer notices the breach and immediately revokes the stolen token, the monitor detects the rejection and immediately triggers a destructive command (rm -rf ~/ on Linux/macOS or a PowerShell user profile deletion on Windows), completely wiping the developer's home directory.

Version 0.5.144 has been removed from the npm registry, and version 0.5.143 is confirmed clean. If you or your team installed the infected version, security firms urge that you do not revoke your GitHub tokens first.

Do Not Immediately Revoke Tokens: Doing so will trigger the machine-wiping routine.

Kill and Remove the Monitor: You must first disable the background monitor. On Linux, this involves running systemctl --user disable --now gh-token-monitor.service and deleting the associated scripts in ~/.config/ and ~/.local/.

Rotate and Cleanse: Once the monitor is eradicated, immediately rotate all secrets (GitHub tokens, npm tokens, AWS keys, and crypto keys) and downgrade the package to 0.5.143. Because of the depth of the data harvesting, rebuilding compromised workstations entirely is highly recommended.