Build Independently confirmed 4 publishers 2 min read Published Oct 8, 2026, 12:21 AM PDT Updated Oct 9, 2026, 2:01 AM PDT

In Tensorlake's npm SDK 0.5.144, a preinstall hook steals credentials before any sandbox runs

Tensorlake's npm SDK 0.5.144 runs a credential-stealing worm from a preinstall hook at install time, Socket reported. According to Socket's analysis, any secret reachable from a workstation or build runner that installed the release may be exposed.

The Engineer · Build desk

Send a correction

Illustration accompanying In Tensorlake's npm SDK 0.5.144, a preinstall hook steals credentials before any sandbox runs — Generated illustration

What happened

Socket flagged the release at 01:23:10 UTC on October 8, 2026, about 11 minutes after it was published at 01:12:07 UTC.
lib/setup.mjs, an obfuscated loader invoked by the hook, uses Bun to launch the worm payload in lib/Math_Symbol.js.
Collection targets include npm and GitHub tokens, AWS credentials from IMDS, ECS, Secrets Manager and SSM, local Vault and Kubernetes credentials, SSH keys and .env files.
To spread, the worm lists packages tied to the victim's publishing identity, builds Sigstore provenance and republishes compromised versions of them.
Those filenames and the install hook match the August ChainDrop / Shai-Hulud compromises of keyv, cacheable and related npm packages.

Why it matters

Who has to decide decision Teams that install the SDK on build runners holding deploy credentials now have to decide whether dependency lifecycle scripts run on those runners at all, since the hook executes only where they are permitted.
Who's exposed exposure Developers building agents stand to lose more than cloud keys, because configuration and MCP files for .claude, .cursor, .kiro, Windsurf and Zed are on the payload's collection list.
What it limits constraint Blocking one command-and-control domain will not cut the payload off, because it looks up its endpoint through an Ethereum contract over about 30 public RPC endpoints, with GitHub as a fallback.
What it limits constraint A Sigstore provenance attestation on a package republished from a victim's account cannot be taken as evidence the code is clean, because the worm generates that provenance itself.

Next story · Build · 3d ago

Tensorlake npm worm ships a service that runs rm -rf ~/ when its stolen GitHub token is revoked

Confirmed2 publishers

The trigger is one entry in the published manifest: `"preinstall": "node lib/setup.mjs"` ^[5]. Where dependency lifecycle scripts are permitted, that line runs during installation ^[6]. Nobody has to import the SDK or start an agent for it to fire ^[6].

Tensorlake's product is isolation. The company sells sandboxes for untrusted, LLM-generated code, with checkpointing, suspend and resume, and its npm SDK creates and manages those environments from TypeScript ^[13]. The sandbox is built to contain the agent's output, and at install time the agent has produced nothing ^[13]^[6]. "A compromised SDK creates exposure on the machine installing it, before generated code reaches a sandbox," the Socket Research Team wrote ^[15]. According to Socket, that machine can be a developer workstation, an application server or a build runner with access to deployment credentials ^[20]. Code executed during the install inherits the permissions of the installing process ^[18].

The package gets about 12,000 weekly downloads and has more than 1,000 stars on GitHub ^[11]. Socket points out that the download figure describes overall usage and does not measure downloads of 0.5.144 or confirmed infections ^[19].

Scoping starts with lockfiles and CI install logs. The question for each machine is whether it resolved 0.5.144 in an install that ran lifecycle scripts ^[1]^[6]. Uninstalling the package does not end the matter: Socket says the payload's persistence can keep attacker access after the dependency is removed ^[14]. Strings in the payload referencing a fake Copilot/Dependabot workflow suggest it also plants GitHub Actions workflows, according to Socket ^[16]. I think the right response for an affected machine is to rotate every credential it could reach, starting with npm tokens ^[3]. Stolen publishing credentials are what let the August wave of this campaign spread to additional packages ^[17].

What to watch

Whether Tensorlake publishes a clean release and an account of how the publishing credential behind 0.5.144 was obtained.
New npm releases republished with Sigstore provenance under identities harvested from machines that installed 0.5.144.
Socket's fuller analysis of the Ethereum contract resolver and whether its RPC and GitHub fallback paths can be disrupted.

Clarity's read

What the record supports and how the coverage leans. The claims behind it follow.

Reality

Evidence74
Adoption25
Hype gap+10
Incentives35
Confidence72

Perspective Coverage

4 publishers

Builder: Builder 44%
Operator: Operator 50%
Investor: Investor 6%

Why these scores

Claim ledger

Ranked by verification strength, evidence, and original report placement.

[1]
Socket detected that tensorlake npm SDK version 0.5.144 was compromised in a ChainDrop / Shai-Hulud supply chain attack, delivering credential-stealing malware.
Reported Supported Source: Socket Research TeamView cited source
[2]
Version 0.5.144 contains obfuscated malware that harvests credentials, exfiltrates secrets, establishes persistence, and executes remotely supplied code.
Reported Supported Source: Socket Research TeamView cited source
[3]
The payload's collection targets include npm tokens (.npmrc files, the npm token API, OIDC token exchange), GitHub tokens checked for repository and workflow permissions, AWS credentials and secrets via IMDS, ECS, Secrets Manager and SSM, HashiCorp Vault at 127.0.0.1:8200, Kubernetes service-account tokens and kubeconfig files, SSH keys, .env files, cryptocurrency wallets and messaging app data.
Reported Supported Source: Socket Research TeamView cited source
[4]
The malicious version was published on October 8, 2026, at 01:12:07 UTC. Socket flagged it at 01:23:10 UTC, approximately 11 minutes after publication.
Reported Supported Source: Socket Research TeamView cited source
[5]
The affected release's published package manifest contains a preinstall hook: "preinstall": "node lib/setup.mjs".
Reported Supported Source: Socket Research TeamView cited source
[6]
Where dependency lifecycle scripts are permitted, the hook gives the malicious loader an execution path during installation; developers do not need to import the SDK or start an agent for the hook to run.
Reported Supported Source: Socket Research TeamView cited source
[7]
Socket flagged two files: package/lib/setup.mjs, an obfuscated loader invoked by the preinstall hook that launches the payload using Bun, and package/lib/Math_Symbol.js, the obfuscated credential-stealing and self-propagating worm payload.
Reported Supported Source: Socket Research TeamView cited source
[8]
The payload targets configuration and MCP files associated with AI development tools .claude, .cursor, .kiro, Windsurf, and Zed.
Reported Supported Source: Socket Research TeamView cited source
[9]
To propagate, the worm enumerates packages associated with the victim's publishing identity, builds Sigstore provenance, and republishes compromised versions.
Reported Supported Source: Socket Research TeamView cited source
[10]
Any secrets accessible to the executing process may be exposed.
Reported Supported Source: Socket Research TeamView cited source
[11]
The tensorlake package receives approximately 12K weekly downloads and has over 1k stars on GitHub.
Reported Supported Source: Socket Research TeamView cited source
[12]
The payload has no hardcoded command-and-control domain; it resolves its endpoint through an Ethereum contract using approximately 30 public RPC endpoints, with a GitHub fallback.
Reported Supported Source: Socket Research TeamView cited source
[13]
Tensorlake provides isolated sandboxes for running untrusted, LLM-generated code, with checkpointing, suspend, and resume capabilities; its npm SDK lets developers create and manage those environments from TypeScript applications.
Reported Supported Source: Socket Research TeamView cited source
[14]
Persistence can retain attacker access after the affected dependency is removed.
Reported Supported Source: Socket Research TeamView cited source
[15]
A compromised SDK creates exposure on the machine installing it, before generated code reaches a sandbox.
Reported Supported Source: Socket Research Team, writtenView cited source
[16]
Strings referencing a fake Copilot/Dependabot workflow suggest the worm also plants GitHub Actions workflows.
Reported Supported Source: Socket Research TeamView cited source
[17]
The installation hook and payload filenames match the structure documented in the August ChainDrop / Shai-Hulud compromises of keyv, cacheable, and related npm packages, where stolen publishing credentials enabled the worm to spread to additional packages.
Reported Supported Source: Socket Research TeamView cited source
[18]
Code executed during installation inherits the permissions of the installing process.
Reported Supported Source: Socket Research TeamView cited source
[19]
The 12K weekly download figure describes the package's overall usage; it does not measure downloads of the malicious version or confirmed infections.
Reported Supported Source: Socket Research TeamView cited source
[20]
Teams may isolate an agent's generated code while installing its SDK on a developer workstation, application server, or build runner with access to deployment credentials and other secrets.
Reported Supported Source: Socket Research TeamView cited source

Sources

4 independent publishers whose own reporting we read for this story.

dev.to
1 article · October 9, 2026
Shai-Hulud Just Infected an AI Agent Platform's npm Package — What Self-Hosted n8n Builders Must Do Now
scworld.com
1 article · October 8, 2026
Tensorlake npm package compromised in supply chain attack
socket.dev
1 article · October 7, 2026
TensorLake npm SDK Compromised in ChainDrop Shai-Hulud Credential-Stealing Attack
thehackernews.com
1 article · October 7, 2026
Tensorlake npm Package Compromised to Deliver Shai-Hulud Credential-Stealing Worm

Clarity analysis

How the coverage leans and what the record actually supports. Read the methodology

Perspective Coverage

How much of the coverage speaks to builders, operators and investors. It measures emphasis, not whether the story is right.

Builder44%

For anyone wiring Tensorlake into a TypeScript agent, the hazard sat at npm install, ahead of the sandbox. Socket's analysis shows the 0.5.144 manifest ran "node lib/setup.mjs" as a preinstall script, so a build runner was exposed whether or not the SDK was ever imported. The dev.to post turns that into a checklist built around npm's ignore-scripts setting. StepSecurity's Ashish Kurmi, quoted by The Hacker News, said the malware "writes .claude/settings.json and .vscode/tasks.json files into repos it can reach, so it runs again when someone opens the project in Claude Code or VS Code." Cleaning a host means checking those repositories as well.

Operator50%

Cleanup order is the practical point for incident responders. Socket says removing the dependency leaves the implant in place, and that a PowerShell monitor polls GitHub with the stolen token and runs an attacker-supplied handler once the token is revoked. The dev.to post, citing The Register, says that handler can delete the user's home directory under some conditions, and advises disabling the monitor before revoking. Socket's own guidance is to rotate credentials from a clean environment while containment is under way. Scope is whatever the installing process could reach: npm and GitHub tokens, AWS metadata and Secrets Manager, a local Vault, kubeconfig files.

Investor6%

The story offers investors little beyond a data point on attacker targeting. Our coverage includes no infection count, no customer impact and no statement from Tensorlake. Socket's figure of about 12,000 weekly downloads describes the package overall, and Socket says plainly it does not measure downloads of the bad version. The commercial interest visible in the reporting belongs to security vendors, with Socket, StepSecurity and Aikido each credited with finding or explaining part of the attack.

Reality

Evidence, adoption, hype gap, incentives and confidence, each read independently from the current record on the scale shown beneath it. How these are measured.

Evidence74: 0100
Detailed teardown, partly relayed
Socket's analysis names the files, quotes the manifest line, gives minute-level timestamps and lists what the malware goes after. The Hacker News adds an independent repository-level account from StepSecurity. Much of the rest is relay: SC World rewrites The Hacker News, and the dev.to post stitches together Socket, Aikido and The Register. Tensorlake does not speak anywhere in our coverage.
Adoption25: 0100
Reach known, infections unknown
About 12,000 weekly downloads, by Socket's count, and Socket itself cautions that this is overall usage. Socket flagged the bad release 11 minutes after it went up, and The Hacker News reports it has since been pulled, but the exact removal time was not published. How many installs fetched 0.5.144 is unreported.
Hype gap+10: −100 understated0 aligned+100 overstated
Slight overstatement downstream
Socket hedges where the facts require it, saying secrets "may be exposed" and tying risk to hosts that permit lifecycle scripts. The stretch comes later. The dev.to post says credentials were stolen "from every machine that installed it" and that "damage is already done", and The Hacker News frames the case as part of a growing trend against AI tools without figures behind the trend.
Incentives35: 0100
Vendor detection story
Socket's post doubles as a showcase for its scanner, opening on the 11-minute detection. Other firms corroborate the technical findings, but the speed figure rests on Socket's own timestamps. The dev.to piece is written to sell a hardening checklist to n8n builders. None of this contradicts the core facts.
Confidence72: 0100
Core facts firm, impact open
The version, the preinstall hook, the two files and the credential targets appear in every account. They trace to Socket's teardown, with StepSecurity separately placing the compromise in the source repository. Confidence drops for the destructive behaviour on token revocation, which the sources describe at different strengths, and for any estimate of who was hit.

In Tensorlake's npm SDK 0.5.144, a preinstall hook steals credentials before any sandbox runs

What happened

Why it matters

What to watch

Clarity's read

Claim ledger

Sources

Topics and entities

Topics

Entities

What happened

Why it matters

What to watch

Clarity's read

Claim ledger

Sources

Topics and entities

Topics

Entities

Related stories