tensorlake 0.5.144 on npm: A Shai-Hulud Worm That Wipes Home on Revoke

On 8 October 2026 at 01:12 UTC, version 0.5.144 of the tensorlake npm package, the TypeScript SDK for Tensorlake's agent infrastructure, was published with a credential-stealing worm in its preinstall hook. The code had been pushed straight to the project's main branch the day before under a maintainer's name, and the repository's own release workflow shipped it. Researchers tie it to the Shai-Hulud family, and it adds a nasty twist: revoking the stolen GitHub token can trigger a wipe of your home directory.

What's affected

• Package: tensorlake on npm.
• Malicious version: 0.5.144 only. OSV tracks it as MAL-2026-17650, and GitHub as GHSA-rqxj-g25x-4v9v.
• Last clean version before the incident: 0.5.143, published 6 October.
• Current state: npm briefly replaced the package with a 0.0.1-security placeholder on 8 October. The maintainers have since published clean releases from 0.5.145 onward.

According to StepSecurity's timeline, the first malicious commit landed on tensorlakeai/tensorlake at 01:20 UTC on 7 October without a pull request, followed by seven more commits, one of which added the preinstall line to package.json. Because the release workflow built from that main branch, 0.5.144 carried a valid npm provenance attestation. Provenance told you where the package was built. It did not tell you the code was safe.

What the payload does, per StepSecurity and Socket's analysis as reported by The Hacker News:

• A preinstall hook runs lib/setup.mjs, which skips itself on CI, so developer machines are the target.
• The loader downloads the Bun runtime and uses it to run an obfuscated file of about 856 KB, lib/Math_Symbol.js.
• It collects GitHub and npm tokens, cloud keys, Kubernetes and Vault secrets, SSH keys, .env files, saved browser logins and configuration files for AI coding tools.
• With a stolen npm token, it republishes the victim's own packages with itself added. With a stolen GitHub token, it commits .claude/settings.json and .vscode/tasks.json into reachable repositories so the payload runs again when someone opens the project in Claude Code or VS Code.
• Stolen data goes to iseekaigogo.com or to a new public repository in the victim's account described as "Shai-Hulud: Here We Go Again".

The hostage piece is a service called gh-token-monitor. It checks the stolen GitHub token against the GitHub API every 60 seconds for up to 24 hours. If GitHub rejects the token, it deletes the user's home directory on Linux and macOS, or the user profile on Windows.

How to check if you're exposed

Search lock files and installed trees for the bad version:

npm ls tensorlake
grep -rn '"tensorlake"' --include=package-lock.json --include=pnpm-lock.yaml --include=yarn.lock .
grep -rlE 'tensorlake-0\.5\.144\.tgz' ~/.npm/_cacache/index-v5 2>/dev/null | head

Then look for the monitor and its persistence on any developer machine that installed the SDK between 8 October and the takedown:

ls -la ~/.config/gh-token-monitor/ ~/.local/bin/gh-token-monitor.sh 2>/dev/null
ls ~/.config/systemd/user/gh-token-monitor.service 2>/dev/null          # Linux
ls ~/Library/LaunchAgents/com.user.gh-token-monitor.plist 2>/dev/null   # macOS

On Windows, look for a logon scheduled task that runs a monitor.ps1 script.

On GitHub, check your account and orgs for new public repositories with the "Shai-Hulud: Here We Go Again" description, commits authored as claude@users.noreply.github.com with the message "chore: update dependencies", and unexpected .claude or .vscode files. If you publish npm packages, list your recent versions and confirm you published each one.

What to do now

1. Remove the monitor before touching tokens. Stop and delete the gh-token-monitor service, script and folder. Back up anything you need first. Revoking the GitHub token while the monitor is alive is exactly what triggers the wipe.

2. Clean the install. Move to a clean release, delete node_modules, and clear the npm cache:

   npm install tensorlake@0.5.143   # or any release from 0.5.145 on
   rm -rf node_modules && npm cache clean --force
   

3. Rotate everything the machine could reach. GitHub and npm tokens, cloud keys, SSH keys, Kubernetes and Vault credentials, .env secrets, AI tool API keys and browser-saved passwords. Do it from a different machine.

4. Audit what you publish. If you own npm packages, check for versions you did not release and deprecate or unpublish them. Remove planted .claude and .vscode files from repositories.

5. Rebuild if in doubt. GitHub's advisory treats any machine that ran the package as fully compromised. If you can't verify it, reinstall it.

6. Turn off install scripts by default. Add ignore-scripts=true to .npmrc on developer machines and allow scripts only for packages that need them.

Why it matters

This release had everything a careful team checks for. It came from the real repository, through the real workflow, with valid provenance. The weak point was upstream: anyone who can push to main can ship a release. Branch protection that requires a reviewed pull request, plus a release job that only runs from protected tags, would have put a human between the attacker's push and npm.

The hostage service also changes incident response. The standard advice after a stolen token is to revoke it immediately. Here, the right order is to remove persistence first, then revoke. Write that into your runbook now, while nobody is panicking.

Try it yourself

Take one service's lock file and list every dependency that declares a preinstall, install or postinstall script. You can read this from package-lock.json entries that set "hasInstallScript": true. Each one is code that runs on a developer laptop the moment someone types npm install. Then drop the same lock file into the free browser scan at https://gold.safeguard.sh/scan to see whether any pinned version matches a known malicious package.

Click through it at your own pace, or open it full screen.

Quick check

Sources

• StepSecurity: Tensorlake npm package compromised, a worm with a hostage token
• The Hacker News: Tensorlake npm package compromised to deliver Shai-Hulud credential-stealing worm
• GitHub Advisory GHSA-rqxj-g25x-4v9v: Malware in tensorlake
• OSV MAL-2026-17650
• tensorlakeai/tensorlake issue #1014
• npm registry metadata for tensorlake