tensorlake · Exploitation confirmed

Malicious npm tensorlake release steals credentials and wipes home directory

Oct 06, 2026 · 1 min read

Version 0.5.144 of the npm package tensorlake contains malicious code that steals credentials on install, spreads to other packages and repos, and deletes the victim's home directory if the stolen GitHub token is revoked. GitHub advisory GHSA-8g63-53c9-65j2 flags the version as malicious, and StepSecurity's analysis found it was still downloadable from npm when checked. Pin to 0.5.143, remove the token monitor before revoking any credentials, and rotate what the malware could reach.

By HIFY Radar newsroom Updated 10/26/2026 01:34 PM Get this every day →← Back to the feed 2 sources

HighSupply chainExploitation confirmedPartial fix

In this article

What happened
Why it matters
What to do
For the technical team
Timeline
Sources

What happened

A release of the tensorlake code package, available on npm, contains malicious code that steals credentials when installed. It tries to spread to other packages and repos, and deletes the user's files if a stolen GitHub token is revoked. GitHub published advisory GHSA-8g63-53c9-65j2 and StepSecurity detailed the attack.

Why it matters

The code steals GitHub and npm tokens, cloud keys, Kubernetes and Vault secrets, SSH keys, browser passwords, and credentials for AI tools such as Claude, Cursor, and Windsurf. Developer machines are the target, and stolen accounts are used to infect other packages and company repos. Revoking the token before cleanup triggers deletion of the home directory.

What to do

Check with npm ls tensorlake and in lockfiles whether version 0.5.144 was installed, or whether the tensorlakeai/tensorlake repo was cloned since October 7; pin to 0.5.143. On affected machines, remove the gh-token-monitor service first, and only then revoke tokens and rotate the remaining credentials. Look for new repos described 'Shai-Hulud' and commits by claude@users.noreply.github.com.

For the technical team

Affected: tensorlake (npm) · npm: tensorlake@0.5.144. GitHub: tensorlakeai/tensorlake main branch, commits e90c47b to 6386121; payload under typescript/lib/.
Exploitation: Malicious version published to npm at 01:12 UTC on October 8, 2026. StepSecurity detected it with AI Package Analyst and reported it to maintainers in issue #1014; advisory GHSA-8g63-53c9-65j2 (critical severity in the reference) flags the version. When StepSecurity checked, 0.5.144 was still downloadable from npm.
Fix: Pin tensorlake to 0.5.143, delete node_modules, and run npm cache clean --force. ignore-scripts=true in .npmrc stops install hooks. No later patched version exists; 0.5.144 must be removed from environments.
Vector: Preinstall hook (setup.mjs) in npm package tensorlake 0.5.144, published by the tensorlakeai/tensorlake repo's own release workflow after malicious commits pushed straight to main under a maintainer identity, with no pull request. The hook skips CI and targets developer machines. Condition: installing the package, or cloning/pulling main since October 7 and running npm install in typescript/. Downloads the Bun runtime and runs an obfuscated 856 KB file.
More details: StepSecurity remediation order: do not revoke tokens before removing the monitor. Check ~/.config/gh-token-monitor/, read the token file, and stop the service (systemctl on Linux, launchctl on macOS, Task Scheduler on Windows); then revoke the GitHub token and rotate npm tokens, cloud keys, SSH, Kubernetes, Vault, secrets in .env, AI tool keys, and browser passwords; check for spread (public "Shai-Hulud" repos, commits by claude@users.noreply.github.com, unexpected .claude and .vscode files); reinstall the machine if cleanliness is uncertain. The monitor checks the token every 60 seconds for up to 24 hours; if GitHub rejects it, it runs rm -rf ~/ (equivalent PowerShell deletion on Windows). The malware writes .claude/settings.json and .vscode/tasks.json to re-run in Claude Code and VS Code. With a stolen npm token, it downloads the victim's packages, adds itself, bumps the version, and republishes. The release carries a valid npm provenance attestation because it was built from the compromised main; the attestation says where a package was built, not that the code is safe. First malicious commit at 01:20 UTC on October 7, 2026; eight commits in total. StepSecurity lists SHA-256 hashes for setup.mjs and Math_Symbol.js in its indicators section. If it only ran in CI, the hook skips itself; rotate the secrets that job could see anyway.