Tensorlake npm package version 0.5.144 hijacked to ship credential-stealing worm

What happened

Version 0.5.144 of the tensorlake npm package was published carrying a payload from the Shai-Hulud worm family, which Socket and The Hacker News also call ChainDrop. It went out through the project's normal GitHub Actions pipeline and carried valid build provenance. The version has since been removed from npm; 0.5.143 is clean.

Endor Labs says the attacker changed the main branch first and let the trusted pipeline publish the result. It calls a compromised maintainer account the most likely root cause, so that is an assessment, not a confirmed fact.

A preinstall hook runs lib/setup.mjs as soon as the package is installed, before any code imports the SDK. The payload hunts for npm and GitHub tokens, SSH keys, cloud credentials, Kubernetes and Docker config, Vault tokens and .env files. It then uses stolen credentials to republish itself into other packages the victim can publish and to create repositories holding stolen data.

The malware also writes .claude/settings.json and .vscode/tasks.json into reachable repositories so it reruns when a project is opened in Claude Code or VS Code. Socket reports that a persistent monitor polls the stolen GitHub token and runs an attacker-supplied handler if the token is revoked. Socket's reading of the code is that revoking the token while the monitor runs can trigger a wipe. No source reports this happening in practice.

Endor Labs says the six tensorlake-native platform packages from the same run contain no install script or payload, but advises treating them as affected and avoiding them.

Timeline

1. 7 Oct 2026
   01:20 UTC

   First malicious commit pushed to the tensorlake source repository.[1]

2. 8 Oct 2026
   01:12 UTC

   tensorlake 0.5.144 published to npm.[3]

3. 8 Oct 2026, 01:23 UTC

   Socket flagged the malicious version, about 11 minutes after publication.[3]

Who is affected

• Anyone who installed tensorlake 0.5.144, on a laptop or in CI, with install scripts enabled.
• Hosts where the install scripts ran should be treated as compromised, along with the accounts and secrets reachable from them.
• Maintainers whose npm or GitHub credentials were on an affected host, since the worm can republish their packages.
• Version 0.5.143 and earlier are not affected.

How to check

1. Search lockfiles, package caches, build logs and deployed artifacts for tensorlake 0.5.144, and note which environments ran the install scripts.
2. On a Mac, look in your LaunchAgents folder for the token monitor property list that Socket describes, named com.user.gh-token-monitor.
3. Review GitHub and npm activity for unexpected new repositories, new tokens or unexpected package publishes.
4. Check repositories you opened for unexpected .claude/settings.json or .vscode/tasks.json files.

What to do

1. First, before anything else: remove the token monitor LaunchAgent, the com.user.gh-token-monitor property list in your user LaunchAgents folder. Socket warns that revoking the stolen GitHub token while it runs can trigger a wipe.
2. Only then revoke and replace npm and GitHub tokens, SSH keys, cloud keys, Vault tokens and other secrets that were reachable from the machine, ideally working from a different computer.
3. Remove 0.5.144, pin tensorlake to 0.5.143 until a known-good release is published, and avoid the tensorlake-native packages at 0.5.144.
4. Removing the npm package does not remove persistence, so isolate the host, investigate, and rebuild affected environments from trusted sources.
5. Audit connected accounts for unauthorized access, unexpected publications, and repository or deployment changes.
6. Consider installing with scripts disabled using the ignore-scripts option.