--- title: tensorlake 0.5.144 on npm carries a Shai-Hulud worm... description: The npm package tensorlake version 0.5.144 was compromised and contains a variant of the Shai-Hulud worm. The attacker pushed malicious code via a verified... canonical: https://daily.dev/posts/tensorlake-0-5-144-on-npm-carries-a-shai-hulud-worm-variant-with-a-wipe-switch-tied-to-token-revocat-ndwjcolod twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: tensorlake 0.5.144 on npm carries a Shai-Hulud worm variant with a wipe switch tied to token revocation | daily.dev og:description: The npm package tensorlake version 0.5.144 was compromised and contains a variant of the Shai-Hulud worm. The attacker pushed malicious code via a verified... og:url: https://daily.dev/posts/tensorlake-0-5-144-on-npm-carries-a-shai-hulud-worm-variant-with-a-wipe-switch-tied-to-token-revocat-ndwjcolod og:image: https://api.daily.dev/og/posts/NdwJcolOD.png og:image:alt: tensorlake 0.5.144 on npm carries a Shai-Hulud worm variant with a wipe switch tied to token revocation og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # tensorlake 0.5.144 on npm carries a Shai-Hulud worm variant with a wipe switch tied to token revocation **[Collections](https://daily.dev/sources/collections)** · 3 min read · 0 upvotes · 0 comments ## Summary The npm package tensorlake version 0.5.144 was compromised and contains a variant of the Shai-Hulud worm. The attacker pushed malicious code via a verified maintainer identity on GitHub, and the package carries a valid npm provenance attestation. A preinstall hook downloads the Bun runtime to execute an obfuscated 856 KB payload that steals GitHub/npm tokens, cloud and SSH keys, Kubernetes and Vault secrets, browser credentials, AI tool configs, and cryptocurrency extension data. The malware spreads by injecting itself into the victim's own npm packages and backdooring GitHub repos with commits appearing to come from claude@users.noreply.github.com. Critically, a dead-man's switch service called gh-token-monitor wipes the home directory (rm -rf ~/) if the stolen GitHub token is revoked — meaning the standard incident response step can destroy your machine. Remediation requires removing gh-token-monitor before revoking any credentials. PyPI and Cargo distributions were not affected. ## Content A malicious release of the tensorlake npm SDK, version 0.5.144, was published on 8 October 2026 and carries a variant of the Shai-Hulud credential-stealing worm. Tensorlake is a cloud platform for running isolated AI agents, and the package gets about 12,000 downloads a week. The code overlaps with the ChainDrop variant used in August against keyv and flat-cache. ## How it got in The attacker pushed code to the tensorlake GitHub repository under a maintainer's identity, uploaded the malicious files directly, and published to npm roughly 20 hours later. The release even carries a valid npm provenance attestation, so it looks legitimate. Socket flagged it 11 minutes after publication. npm removed it, and Tensorlake shipped 0.5.145 as a replacement. PyPI and Cargo distributions of tensorlake were not affected at the time of reporting. ## What it does A preinstall hook downloads the Bun runtime and uses it to run an obfuscated payload of about 856 KB. The payload collects: - GitHub and npm tokens - AWS and other cloud credentials - SSH keys - Kubernetes and HashiCorp Vault secrets - GitHub Actions secrets and environment variables - crypto wallets and browser-stored passwords - configs for AI tools such as Claude, Cursor, Kiro and Windsurf The browser theft is new in this variant: it drops a HackBrowserData binary to pull credentials and cryptocurrency extension data. It spreads by republishing the victim's npm packages with itself injected. It also commits backdoor files (.claude/settings.json and .vscode/tasks.json) to the victim's GitHub repos. The command-and-control domain, iseekaigogo[.]com, is resolved through a blockchain dead drop: an Ethereum smart contract tied to a threat-actor wallet. ## The part that makes cleanup dangerous The malware installs a persistent service called gh-token-monitor. If the stolen GitHub token is revoked while that service is still running, it executes rm -rf ~/ and wipes the user's home directory. Revoking the token is the obvious first move after a leak, and here it is the one that destroys your machine. Socket also points out that the SDK's install script can run outside Tensorlake's sandbox. The host can be compromised before any AI-generated code ever executes. ## If you installed 0.5.144 1. Isolate the affected host. 2. Remove the gh-token-monitor service first. Do not revoke any credentials until it is gone. 3. Then rotate GitHub, npm, cloud, SSH and other secrets, and audit connected accounts and repos. 4. Pin tensorlake to 0.5.143 or move to 0.5.145. ## Indicators of compromise - Domain: iseekaigogo[.]com - GitHub repos with the description "Shai-Hulud: Here We Go Again" - Commits from claude@users.noreply.github.com - Unexpected .claude/settings.json or .vscode/tasks.json files in your repos This is the worm's first reported appearance in AI infrastructure tooling, and a package built to isolate untrusted code was the way in. ## Questions this post answers ### Is tensorlake on npm compromised and which version is safe? tensorlake version 0.5.144 on npm is compromised and carries the Shai-Hulud worm. Version 0.5.143 is the last safe version. PyPI and Cargo distributions of tensorlake were not affected. The malicious release carries a valid npm provenance attestation, making it appear legitimate, but provenance only proves where the build came from, not that the code is safe. _Developers maintaining npm dependencies can track supply chain incidents like this on daily.dev before they hit production._ ### What does the tensorlake 0.5.144 malware steal and how does it spread? The payload steals GitHub and npm tokens, cloud and SSH keys, Kubernetes and Vault secrets, browser credentials, AI tool configs, and cryptocurrency extension data via a dropped HackBrowserData binary. It spreads by injecting itself into the victim's own npm packages and by committing backdoor files (.claude/settings.json and .vscode/tasks.json) to GitHub repos, with commits appearing from claude@users.noreply.github.com. _Teams auditing npm packages for unexpected releases or repo backdoors find incident coverage like this on daily.dev._ ### Why should I not revoke my GitHub token immediately if I installed tensorlake 0.5.144? Revoking the stolen GitHub token triggers a dead-man's switch: a service called gh-token-monitor runs rm -rf ~/ when it detects the token has been revoked, wiping your entire home directory. The correct remediation order is to find and remove the gh-token-monitor service first, and only then rotate GitHub tokens, npm tokens, cloud keys, SSH keys, and Kubernetes or Vault secrets. _Staying ahead of supply chain attacks and their non-obvious remediation steps is easier when you follow security coverage on daily.dev._ ## Similar posts on daily.dev - [New Shai-Hulud malware wave compromises 600 npm packages](https://daily.dev/posts/new-shai-hulud-malware-wave-compromises-600-npm-packages-fc6izpxyv) · BleepingComputer · 5 upvotes · 1 comments - [Mini Shai-Hulud Strikes Again: 317 npm Packages Compromised](https://daily.dev/posts/mini-shai-hulud-strikes-again-317-npm-packages-compromised-u2ptexbxr) · Hacker News · 2 upvotes · 0 comments - [Shai-Hulud copycat worm infects yet another npm package](https://daily.dev/posts/shai-hulud-copycat-worm-infects-yet-another-npm-package-6qyti32ms) · The Register · 0 upvotes · 0 comments - [Mini Shai-Hulud strikes again: npm worm compromises hundreds of @antv packages](https://daily.dev/posts/mini-shai-hulud-strikes-again-npm-worm-compromises-hundreds-of-antv-packages-gsrjcznzd) · Aikido Security · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#github](https://daily.dev/tags/github), [#malware](https://daily.dev/tags/malware), [#npm](https://daily.dev/tags/npm) [View this post on daily.dev](https://daily.dev/posts/tensorlake-0-5-144-on-npm-carries-a-shai-hulud-worm-variant-with-a-wipe-switch-tied-to-token-revocat-ndwjcolod) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"tensorlake 0.5.144 on npm carries a Shai-Hulud worm variant with a wipe switch tied to token revocation","url":"https://daily.dev/posts/tensorlake-0-5-144-on-npm-carries-a-shai-hulud-worm-variant-with-a-wipe-switch-tied-to-token-revocat-ndwjcolod","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/tensorlake-0-5-144-on-npm-carries-a-shai-hulud-worm-variant-with-a-wipe-switch-tied-to-token-revocat-ndwjcolod"},"datePublished":"2026-10-08T03:53:39.540Z","dateModified":"2026-10-08T17:13:41.731Z","description":"The npm package tensorlake version 0.5.144 was compromised and contains a variant of the Shai-Hulud worm. The attacker pushed malicious code via a verified...","isAccessibleForFree":true,"articleSection":"Collections","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Collections","logo":"https://media.daily.dev/image/upload/s--fk_6ycEi--/f_auto,q_auto/v1780996001/logos/collections?_a=BAMAMiWQ0","url":"https://daily.dev/sources/collections"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/tensorlake-0-5-144-on-npm-carries-a-shai-hulud-worm-variant-with-a-wipe-switch-tied-to-token-revocat-ndwjcolod","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,github,malware,npm","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Collections","item":"https://daily.dev/sources/collections"},{"@type":"ListItem","position":3,"name":"tensorlake 0.5.144 on npm carries a Shai-Hulud worm variant with a wipe switch tied to token revocation"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/tensorlake-0-5-144-on-npm-carries-a-shai-hulud-worm-variant-with-a-wipe-switch-tied-to-token-revocat-ndwjcolod#faq","mainEntity":[{"@type":"Question","name":"Is tensorlake on npm compromised and which version is safe?","acceptedAnswer":{"@type":"Answer","text":"tensorlake version 0.5.144 on npm is compromised and carries the Shai-Hulud worm. Version 0.5.143 is the last safe version. PyPI and Cargo distributions of tensorlake were not affected. The malicious release carries a valid npm provenance attestation, making it appear legitimate, but provenance only proves where the build came from, not that the code is safe. Developers maintaining npm dependencies can track supply chain incidents like this on daily.dev before they hit production."}},{"@type":"Question","name":"What does the tensorlake 0.5.144 malware steal and how does it spread?","acceptedAnswer":{"@type":"Answer","text":"The payload steals GitHub and npm tokens, cloud and SSH keys, Kubernetes and Vault secrets, browser credentials, AI tool configs, and cryptocurrency extension data via a dropped HackBrowserData binary. It spreads by injecting itself into the victim's own npm packages and by committing backdoor files (.claude/settings.json and .vscode/tasks.json) to GitHub repos, with commits appearing from claude@users.noreply.github.com. Teams auditing npm packages for unexpected releases or repo backdoors find incident coverage like this on daily.dev."}},{"@type":"Question","name":"Why should I not revoke my GitHub token immediately if I installed tensorlake 0.5.144?","acceptedAnswer":{"@type":"Answer","text":"Revoking the stolen GitHub token triggers a dead-man's switch: a service called gh-token-monitor runs rm -rf ~/ when it detects the token has been revoked, wiping your entire home directory. The correct remediation order is to find and remove the gh-token-monitor service first, and only then rotate GitHub tokens, npm tokens, cloud keys, SSH keys, and Kubernetes or Vault secrets. Staying ahead of supply chain attacks and their non-obvious remediation steps is easier when you follow security coverage on daily.dev."}}]} ```