What happened?
On 8 October 2026, researchers identified a malicious release of tensorlake@0.5.144, the npm software development kit (SDK) for Tensorlake, a cloud-native platform that enables developers to run AI agents and AI-generated code in isolated environments. The compromised package, which averages approximately 12,000 downloads per week, was detected approximately 11 minutes after publication and was subsequently removed from npm, with a clean replacement version released shortly afterwards.
The incident has been linked to "Shai-Hulud", a credential-stealing and self-propagating worm that has repeatedly targeted the npm ecosystem, with further research by Socket noting similarities to the ChainDrop campaign, which previously compromised npm packages by abusing stolen publishing credentials.
Unlike traditional malware that relies on phishing or user interaction, the malicious code executed automatically during package installation. The compromised release contained a preinstall hook that launched an obfuscated loader before executing the primary payload using the Bun JavaScript runtime. Developers did not need to import the SDK or run any Tensorlake workloads for the malware to execute.
This distinction is particularly important because the malicious activity occurred outside Tensorlake's sandbox protections; while Tensorlake isolates AI agents and generated code, installation of the SDK takes place directly on developer workstations, application servers and CI/CD runners, where deployment credentials, cloud secrets and package publishing tokens may be accessible.
Once executed, the malware attempted to harvest credentials and sensitive information from a wide range of locations, including local files, CI/CD environments and browser profiles, with stolen data reportedly including npm tokens, GitHub tokens, cryptocurrency wallets and configuration files associated with several AI development tools.
It was also observed that this malware could use an Ethereum smart contract to resolve command-and-control infrastructure, providing a mechanism for operators to update destinations without publishing a new package version. The malware also attempted to propagate using compromised publishing identities, enumerating packages associated with a victim's publishing account and potentially republishing compromised versions, extending the attack to downstream users.
A particularly concerning feature involved monitoring stolen GitHub tokens - under specific circumstances, if a compromised token was revoked, a built-in "hostage token" mechanism could trigger attacker-supplied code designed to wipe the victim's home directory; similar destructive functionality has been observed in previous Shai-Hulud campaigns.
So what?
This incident demonstrates how software supply chain attacks continue to expand into the rapidly growing ecosystem of AI tools and services.
The attack did not compromise Tensorlake’s sandboxing technology itself. Instead, it targeted the trusted dependency that developers install to interact with the platform; organisations often focus on securing production environments while overlooking the privileged access available to development tooling and software dependencies.
This also illustrates why trusted repositories cannot be treated as inherently safe - a malicious dependency can execute during a legitimate installation process without requiring users to click a suspicious link or open a malicious attachment, making prevention and detection significantly more challenging. For threat actors, a compromised developer workstation or build system can provide access to source code repositories and cloud environments, with the self-propagating nature of Shai-Hulud increasing the potential impact, allowing stolen credentials to be leveraged in attempts to compromise additional packages and organisations.
The incident further demonstrates that AI development environments can become attractive targets where access to source code, cloud credentials and software supply chains converge.
What should I do?
Given Shai-Hulud's credential theft, persistence and self-propagation capabilities, organisations should assume that any environment where the malicious package executed may have been exposed and respond accordingly.
- Identify affected installations - Review dependency manifests, build logs and deployed artefacts for tensorlake@0.5.144.
- Treat affected systems as compromised - Any host that executed the package's installation script should be investigated for credential exposure, persistence mechanisms and unauthorised activity.
- Remove persistence before revoking credentials - Researchers warn that the malware's token-monitoring functionality may trigger destructive behaviour if certain GitHub tokens are revoked while the monitoring component remains active.
- Rotate potentially exposed credentials - Once affected hosts have been isolated and investigated, rotate any credentials for GitHub, npm, cloud, Kubernetes, Vault, SSH and CI/CD from a known-clean environment.
- Monitor for indicators of compromise - Security teams should search for the identified malicious package, associated file hashes, command-and-control infrastructure and Ethereum-based infrastructure indicators linked to the campaign, alongside evidence of credential theft, persistence mechanisms and unauthorised activity within development environments.
- Rebuild affected environments - Researchers recommend rebuilding compromised systems from trusted sources before restoring access to sensitive credentials.
As organisations increasingly rely on open-source packages, cloud services and AI development tools, a compromise affecting a single dependency can provide threat actors with access to developer workstations, build systems, source code repositories and deployment infrastructure.
Indicators of Compromise (IoCs)
- Malicious npm package: tensorlake@0.5.144
- Tarball SHA-1: 843a898ab72793568d77c53ff9282e6ce7c66aea
- C2 domain: iseekaigogo[.]com
- Ethereum contract: 0xb614155Fd88114d40549b259457Bcf921Df091B9
- File SHA-256: lib/setup.mjs - 25a0735d0db7dc40e5d45ce42d9c106067e6a66e184d967cfecfab17c3bcb5ef
- File SHA-256: lib/Math_Symbol.js - b50a00900399ba99fb6ce1fc151519cb99d44320ef2a631f2237e1aea0ad6fec