Tensorlake NPM Package Compromised by Shai-Hulud Worm

Executive Summary

On October 7, 2026, a critical software supply chain attack was discovered involving the tensorlake npm package. Version 0.5.144 of the package was compromised to include a self-propagating credential-stealing worm, part of the broader Shai-Hulud (also known as ChainDrop) campaign. The malware harvests a wide range of sensitive data from developer environments and CI/CD pipelines, including API keys, private keys, and cloud credentials. Its self-propagation mechanism allows it to infect other npm packages using the compromised developer's credentials, posing a significant and expanding threat to the software ecosystem. The use of a public blockchain for command-and-control (C2) makes the threat highly resilient to takedown efforts. Organizations using this package must immediately remove the malicious version, rotate all potentially exposed credentials, and audit their CI/CD environments for signs of compromise.

Threat Overview

The attack began with a malicious commit to the official tensorlakeai/tensorlake GitHub repository on October 7, 2026, pushed under a legitimate maintainer's name. A day later, the project's own release workflow published the compromised package, version 0.5.144, to the public npm registry. The package contained a preinstall hook, a script that automatically executes upon installation. This hook initiated a chain of events, starting with an obfuscated loader that used the Bun runtime to execute the primary payload: the Shai-Hulud worm.

The worm is a sophisticated information stealer designed to exfiltrate a comprehensive set of developer secrets. It targets credentials for npm, GitHub, Amazon Web Services (AWS), HashiCorp Vault, and Kubernetes, as well as SSH keys and cryptocurrency wallets. The malware also specifically searches for configuration files related to AI development tools, indicating a focused effort to compromise AI infrastructure.

Technical Analysis

The attack leverages several advanced techniques to achieve its objectives. The infection vector is a classic supply chain attack, compromising a legitimate package to distribute malware.

Attack Chain

1. Initial Compromise: The threat actor gains access to a maintainer's account or the project's GitHub repository.
2. Malicious Code Injection: A rogue commit adds obfuscated code and a preinstall script to the package.json file.
3. Publication: The project's automated CI/CD pipeline builds and publishes the malicious version (0.5.144) to the npm registry.
4. Execution: A developer or automated build system installs the compromised package, triggering the preinstall hook.
5. Payload Deployment: The hook executes an obfuscated loader using the Bun runtime, which in turn runs the main Shai-Hulud payload.
6. Credential Theft: The worm scans the environment for credentials, secrets, and configuration files. It also deploys the HackBrowserData binary to steal browser data.
7. Propagation: The worm uses stolen npm and GitHub tokens to enumerate all other packages owned by the victim and republishes them with the same malicious payload. It even generates Sigstore provenance to make the new packages appear legitimate.
8. C2 Communication: The malware communicates with its C2 infrastructure via an Ethereum smart contract, with GitHub used as a fallback mechanism. This decentralized approach makes it extremely difficult to disrupt.

MITRE ATT&CK Techniques

• T1195.002 - Compromise Software Supply Chain: The core of the attack involves injecting malicious code into a legitimate software package.
• T1059.007 - JavaScript/TypeScript: The malware is executed via npm's preinstall hook, which runs a JavaScript-based payload.
• T1555.003 - Credentials from Web Browsers: The use of the HackBrowserData tool indicates theft of credentials stored in web browsers.
• T1552.004 - Private Keys: The malware specifically targets SSH keys and cryptocurrency wallets.
• T1134 - Access Token Manipulation: Stolen npm and GitHub tokens are used to propagate the worm.
• T1071.004 - DNS: While using a blockchain, the underlying principle is similar to using a non-standard protocol for C2 resolution, making it a form of Application Layer Protocol abuse.

Impact Assessment

The impact of this attack is severe and multi-faceted. For developers and organizations that installed the malicious package, the immediate risk is the complete compromise of their development environment. The theft of AWS, Kubernetes, and HashiCorp Vault credentials could lead to a full-scale breach of cloud infrastructure, data exfiltration, and significant financial loss. The theft of cryptocurrency wallets poses a direct financial risk.

The self-propagating nature of the worm exponentially increases the attack's scope. Each compromised developer becomes a new distribution point, potentially infecting dozens of other projects and their downstream users. This creates a cascading supply chain crisis that is difficult to contain. The attack also erodes trust in the open-source ecosystem and highlights the fragility of package manager security.

IOCs — Directly from Articles

No specific file hashes, IP addresses, or domains were provided in the source articles.

Cyber Observables — Hunting Hints

Security teams may want to hunt for the following patterns to detect potential compromise:

Detection & Response

Detection:

1. Dependency Scanning: Use software composition analysis (SCA) tools to check for the presence of tensorlake version 0.5.144 in all projects and build environments. Tools should be configured to flag packages with preinstall scripts for manual review.
2. Behavioral Monitoring: On CI/CD runners and developer endpoints, monitor for suspicious process chains, such as npm spawning bun. Use EDR solutions to detect the execution of unexpected binaries like HackBrowserData.
3. Egress Filtering: Monitor and restrict outbound network traffic from build environments. Connections to cryptocurrency networks or unknown APIs should be blocked and investigated. This can help disrupt the C2 communication. (D3FEND: D3-OTF: Outbound Traffic Filtering)
4. Log Analysis: Ingest CI/CD and version control system logs into a SIEM. Create alerts for developers publishing a large number of package updates in a short period, which could indicate automated propagation. (D3FEND: D3-SFA: System File Analysis)

Response:

1. Isolate: Immediately isolate any system where tensorlake@0.5.144 was installed.
2. Remove: Remove the malicious package from all projects.
3. Credential Rotation: Assume all secrets on the affected systems are compromised. Rotate all developer tokens, API keys, SSH keys, and cloud credentials.
4. Audit: Audit version control and package registry logs for any unauthorized package publications originating from compromised accounts.
5. Notify: Inform downstream users of any packages that were maliciously republished by the worm.

Mitigation

Strategic:

• Enforce Signed Commits and Packages: Use features like GitHub's signed commits and npm's package signing to ensure the integrity and provenance of code and published artifacts. (D3FEND: D3-SBV: Service Binary Verification)
• Vet Dependencies: Implement a process for vetting new open-source dependencies before they are introduced into a project. Analyze packages for risky scripts like preinstall.
• Principle of Least Privilege: Ensure that CI/CD pipelines and developer accounts have the minimum necessary permissions. Build processes should not have credentials capable of publishing to package registries unless explicitly required for a release.

Tactical:

• Disable Automatic Script Execution: Configure npm to ignore preinstall and postinstall scripts by default using npm config set ignore-scripts true. Scripts can be run on a case-by-case basis after manual review.
• Use Immutable Versions: Pin dependency versions in package-lock.json or yarn.lock to prevent unexpected updates to malicious versions.
• Network Segmentation: Isolate build environments from the corporate network and restrict their access to the internet. (D3FEND: D3-NI: Network Isolation)