Tensorlake npm Package Compromised to Deliver Shai-Hulud Credential-Stealing Worm

How the Malware Operated in Developer Environments

A malicious version of the tensorlake npm package, a TypeScript SDK for Tensorlake applications, was compromised on October 8, 2026, as part of a supply chain attack linked to the ChainDrop and Shai-Hulud threat actors. The infected version 0.5.144 contained obfuscated malware designed to harvest credentials from developer environments. Security researchers identified the breach during routine package analysis, noting unusual network activity tied to the update. The compromise affected users who installed or updated the package between October 7 and October 9, 2026. Tensorlake officials confirmed the breach and urged immediate action to mitigate risks.

The malicious code in tensorlake version 0.5.144 used obfuscation techniques to evade detection while executing credential theft routines. Once installed, it collected environment variables, SSH keys, and authentication tokens from local machines and transmitted them to external servers controlled by attackers. The malware specifically targeted developers working with cloud-native applications and AI workflows, exploiting trust in legitimate open-source dependencies. Analysis showed the payload activated silently during package initialization, making it difficult to trace without advanced monitoring tools. The attack leveraged the popularity of tensorlake in AI development circles to maximize reach.

What Steps Should Developers Take Now?

Developers who installed tensorlake version 0.5.144 should immediately remove the package and rotate all potentially exposed credentials, including API keys, database passwords, and cloud access tokens. Systems should be scanned for signs of unauthorized access or data exfiltration dating back to early October. Tensorlake has released a clean version, 0.5.145, and advised users to update only after verifying the package’s integrity through official channels. Security teams recommend implementing software bill of materials (SBOM) checks and dependency verification protocols to prevent similar incidents. Continuous monitoring of npm registry activity is now considered essential for maintaining supply chain hygiene.

How did attackers gain access to the tensorlake package? Attackers likely compromised the package through a hijacked maintainer account or by exploiting a vulnerability in the publishing pipeline, allowing them to upload the malicious version without detection.

Frequently Asked Questions

Is tensorlake still safe to use after updating to version 0.5.145? Yes, version 0.5.145 has been verified as clean and secure by Tensorlake’s security team, though users should confirm authenticity via official signatures before installation.

Can the stolen credentials be used to access cloud services? Yes, if attackers obtained valid tokens or keys, they could potentially infiltrate cloud accounts, deploy resources, or exfiltrate data unless multi-factor authentication and credential rotation are enforced.