Shai-Hulud reaches the Tensorlake npm SDK, with a wiper that fires when you revoke the stolen token
tensorlake@0.5.144, published from the project's own release workflow after commits pushed under a maintainer's name, carried a ChainDrop/Shai-Hulud credential stealer. A token monitor wipes the home directory if the stolen GitHub token is revoked first.
The npm SDK for Tensorlake, a platform for running AI agents and untrusted AI-written code in sandboxes, shipped a credential-stealing worm in version 0.5.144. According to StepSecurity, the first malicious commit landed directly on the main branch of tensorlakeai/tensorlake at 01:20 UTC on October 7 under a maintainer's name, and the repository's own release workflow published the package at 01:12 UTC on October 8, so it carried valid provenance. Socket flagged it 11 minutes later. A preinstall hook runs a Bun-based payload, linked by researchers to the ChainDrop variant of Shai-Hulud, that takes npm, GitHub, AWS, Kubernetes and HashiCorp Vault credentials, SSH keys, .env files and AI tool configs, then republishes the victim's other packages. Tensorlake released 0.5.145; how the attacker got the maintainer's access is not public.
Why it matters
Provenance did its job and still did not help: it proved the package came from the real repository's workflow, and the attacker was inside that repository. What failed was the identity allowed to push to main without review, and a release pipeline that trusts whatever is on main. Branch protection on release branches, and treating maintainer push rights as a publishing credential, are the controls to check.
The incident response order also changes. If a GitHub token was stolen, the malware installs a gh-token-monitor service that checks it every 60 seconds and, per StepSecurity, deletes the home directory once it is revoked. Remove that persistence first, then rotate npm, cloud, Vault and SSH credentials, and rebuild hosts that ran the install. The skip-on-CI check means developer laptops are the main target. See secrets in repositories and CI and our coverage of the Shai-Hulud variant that hunts 469 credential locations. Coverage from The Register adds that the SDK sees about 12,000 weekly downloads.
Source: The Hacker News
Related on Start with Identity
- BlogA hijacked AI coding assistant session spread Shai-Hulud to about 100 internal repositories
Mandiant describes an intrusion at an unnamed SaaS provider where a poisoned package, recommended through a developer's AI coding assistant session, led to stol
- BlogGitLab's incoming email address is a non-expiring token that commits code and runs CI as you
Aikido Security showed that the personal address GitLab issues for creating issues by email can also open merge requests that GitLab commits in your name and ca
- BlogGheist turns stolen GitHub tokens into secret dumps through Actions logs
Wiz reported on October 25 that the Gheist campaign used stolen GitHub tokens from infostealer logs and past supply-chain leaks to plant more than 13,500 ci-syn
- CVEJFrog Artifactory checks a token's signature and issuer but not its scope
Self-hosted Artifactory before 7.133.11 validated access token signatures and issuers without enforcing scope, so a low-privilege token could perform admin acti
- CVEJFrog Artifactory hands its internal anonymous-user token to unauthenticated callers
Self-hosted Artifactory could return an internal anonymous-user token to an unauthenticated request even with anonymous access disabled. Attackers chained it wi
- CVEOver-scoped CodeBuild GitHub token let an attacker ship code in Amazon Q Developer 1.84.0
An inappropriately scoped GitHub token in the CodeBuild configuration for the Amazon Q Developer VS Code extension let an attacker commit code that shipped auto