--- title: TensorLake npm SDK Compromised in ChainDrop Shai-Hulud... description: Socket Research Team detected that tensorlake npm SDK version 0.5.144 was compromised in a ChainDrop / Shai-Hulud supply chain attack. The malicious release,... canonical: https://daily.dev/posts/tensorlake-npm-sdk-compromised-in-chaindrop-shai-hulud-credential-stealing-attack-lxxzh37wl twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: TensorLake npm SDK Compromised in ChainDrop Shai-Hulud Credential-Stealing Attack | daily.dev og:description: Socket Research Team detected that tensorlake npm SDK version 0.5.144 was compromised in a ChainDrop / Shai-Hulud supply chain attack. The malicious release,... og:url: https://daily.dev/posts/tensorlake-npm-sdk-compromised-in-chaindrop-shai-hulud-credential-stealing-attack-lxxzh37wl og:image: https://api.daily.dev/og/posts/LXxzh37WL.png og:image:alt: TensorLake npm SDK Compromised in ChainDrop Shai-Hulud Credential-Stealing Attack og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # TensorLake npm SDK Compromised in ChainDrop Shai-Hulud Credential-Stealing Attack **[Socket](https://daily.dev/sources/socketdev)** · 5 min read · 1 upvotes · 0 comments ## Summary Socket Research Team detected that tensorlake npm SDK version 0.5.144 was compromised in a ChainDrop / Shai-Hulud supply chain attack. The malicious release, published October 8 2026, contains a preinstall hook that launches obfuscated malware capable of harvesting npm tokens, GitHub tokens, AWS credentials, HashiCorp Vault secrets, Kubernetes credentials, SSH keys, and AI tool configs (Claude, Cursor, Kiro, Windsurf). The payload is a self-propagating worm that spreads by republishing to other packages under the victim's npm identity. It resolves its C2 endpoint via an Ethereum smart contract and includes a dead-man switch: revoking the stolen GitHub token while a persistent monitor is still running triggers a wipe of the user's home directory. Remediation requires removing the token monitor before revoking any credentials, isolating affected hosts, and auditing connected accounts. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What does the tensorlake npm package version 0.5.144 compromise do and how do I remediate it? tensorlake@0.5.144 contains a preinstall hook that runs obfuscated malware stealing npm tokens, GitHub tokens, AWS credentials, Vault secrets, Kubernetes credentials, SSH keys, and AI tool configs. The payload is a self-propagating worm and includes a dead-man switch: revoking the stolen GitHub token while the monitor is active wipes the user's home directory. Remediation requires stopping the gh-token-monitor persistence mechanism on each affected host before revoking any credentials, then isolating hosts and auditing connected accounts. _Teams managing npm dependencies in CI/CD pipelines track supply chain incidents like this on daily.dev._ ### How does the ChainDrop Shai-Hulud npm attack avoid having a hardcoded C2 server? The ChainDrop / Shai-Hulud payload resolves its command-and-control endpoint through an Ethereum smart contract, querying approximately 30 public RPC endpoints with a GitHub fallback. This means there is no hardcoded domain to block, and the attacker can update the endpoint by writing to the contract. The same resolver design was reported in the earlier keyv and cacheable package compromises. _Developers defending npm-based infrastructure follow emerging attack patterns like ChainDrop on daily.dev._ ### How do I remove the gh-token-monitor persistence left by the tensorlake malware before revoking credentials? On Linux, run `systemctl --user disable --now gh-token-monitor.service` and delete `~/.config/gh-token-monitor/`. On macOS, unload `~/Library/LaunchAgents/com.user.gh-token-monitor.plist`. On Windows, delete the ONLOGON scheduled task running `monitor.ps1`. Only after the monitor is fully removed should you revoke the stolen GitHub token — revoking it while the monitor is still running triggers the dead-man switch and wipes the user's home directory. _Developers cleaning up after a compromised npm package find step-by-step incident coverage on daily.dev._ ## Similar posts on daily.dev - [Massive ChainDrop npm supply-chain attack infects hundreds of packages](https://daily.dev/posts/massive-chaindrop-npm-supply-chain-attack-infects-hundreds-of-packages-uhzbslfdu) · BleepingComputer · 3 upvotes · 1 comments - [Mini Shai-Hulud Campaign Hits Red Hat Cloud Services npm Pac...](https://daily.dev/posts/mini-shai-hulud-campaign-hits-red-hat-cloud-services-npm-pac--jlxgalom3) · Socket · 0 upvotes · 0 comments - [Mini Shai-Hulud Strikes Again: 317 npm Packages Compromised](https://daily.dev/posts/mini-shai-hulud-strikes-again-317-npm-packages-compromised-u2ptexbxr) · Hacker News · 2 upvotes · 0 comments --- Tags: [#cyber](https://daily.dev/tags/cyber), [#malware](https://daily.dev/tags/malware), [#npm](https://daily.dev/tags/npm) [View this post on daily.dev](https://daily.dev/posts/tensorlake-npm-sdk-compromised-in-chaindrop-shai-hulud-credential-stealing-attack-lxxzh37wl) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"TensorLake npm SDK Compromised in ChainDrop Shai-Hulud Credential-Stealing Attack","url":"https://daily.dev/posts/tensorlake-npm-sdk-compromised-in-chaindrop-shai-hulud-credential-stealing-attack-lxxzh37wl","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/tensorlake-npm-sdk-compromised-in-chaindrop-shai-hulud-credential-stealing-attack-lxxzh37wl"},"datePublished":"2026-10-08T04:23:25.947Z","dateModified":"2026-10-08T17:13:26.705Z","description":"Socket Research Team detected that tensorlake npm SDK version 0.5.144 was compromised in a ChainDrop / Shai-Hulud supply chain attack. The malicious release,...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/62d2956f5131ec802b3b9fc58d95a09a?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/62d2956f5131ec802b3b9fc58d95a09a?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Socket","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Socket","logo":"https://media.daily.dev/image/upload/s---oEn9czC--/f_auto/v1716187892/logos/socketdev","url":"https://daily.dev/sources/socketdev"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/tensorlake-npm-sdk-compromised-in-chaindrop-shai-hulud-credential-stealing-attack-lxxzh37wl","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"cyber,malware,npm","timeRequired":"PT5M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Socket","item":"https://daily.dev/sources/socketdev"},{"@type":"ListItem","position":3,"name":"TensorLake npm SDK Compromised in ChainDrop Shai-Hulud Credential-Stealing Attack"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/tensorlake-npm-sdk-compromised-in-chaindrop-shai-hulud-credential-stealing-attack-lxxzh37wl#faq","mainEntity":[{"@type":"Question","name":"What does the tensorlake npm package version 0.5.144 compromise do and how do I remediate it?","acceptedAnswer":{"@type":"Answer","text":"tensorlake@0.5.144 contains a preinstall hook that runs obfuscated malware stealing npm tokens, GitHub tokens, AWS credentials, Vault secrets, Kubernetes credentials, SSH keys, and AI tool configs. The payload is a self-propagating worm and includes a dead-man switch: revoking the stolen GitHub token while the monitor is active wipes the user's home directory. Remediation requires stopping the gh-token-monitor persistence mechanism on each affected host before revoking any credentials, then isolating hosts and auditing connected accounts. Teams managing npm dependencies in CI/CD pipelines track supply chain incidents like this on daily.dev."}},{"@type":"Question","name":"How does the ChainDrop Shai-Hulud npm attack avoid having a hardcoded C2 server?","acceptedAnswer":{"@type":"Answer","text":"The ChainDrop / Shai-Hulud payload resolves its command-and-control endpoint through an Ethereum smart contract, querying approximately 30 public RPC endpoints with a GitHub fallback. This means there is no hardcoded domain to block, and the attacker can update the endpoint by writing to the contract. The same resolver design was reported in the earlier keyv and cacheable package compromises. Developers defending npm-based infrastructure follow emerging attack patterns like ChainDrop on daily.dev."}},{"@type":"Question","name":"How do I remove the gh-token-monitor persistence left by the tensorlake malware before revoking credentials?","acceptedAnswer":{"@type":"Answer","text":"On Linux, run `systemctl --user disable --now gh-token-monitor.service` and delete `~/.config/gh-token-monitor/`. On macOS, unload `~/Library/LaunchAgents/com.user.gh-token-monitor.plist`. On Windows, delete the ONLOGON scheduled task running `monitor.ps1`. Only after the monitor is fully removed should you revoke the stolen GitHub token — revoking it while the monitor is still running triggers the dead-man switch and wipes the user's home directory. Developers cleaning up after a compromised npm package find step-by-step incident coverage on daily.dev."}}]} ```