The Pulse
Tensorlake’s Malicious npm Release Targeted Developer Credentials
Tensorlake says a compromised maintainer account published malicious npm version 0.5.144 on October 8, 2026. The install-time payload targeted developer credentials and AI-tool configuration, while the company says the release was not autho
AI.info Team · Written with AI ·
For about 1 hour and 40 minutes on October 8, npm hosted a malicious release of Tensorlake’s TypeScript SDK. Version 0.5.144 appeared between 01:12 and 02:54 UTC after an attacker used a compromised maintainer account to push code to Tensorlake’s repository and publish through its release workflow, the company said. The release even carried valid npm provenance, but that did not make it authorized.
“This version was not an authorized Tensorlake release.”
Tensorlake security advisory
The advisory identifies the npm release as the affected distribution and says Tensorlake’s PyPI and crates.io packages, along with its command-line tool, were not affected. It lists version 0.5.144 for the main package and platform-specific native packages. Tensorlake also said it had seen no use of that version through the SDK usage it monitors.
Version 0.5.144 ran during installation
The compromised package used a preinstall hook to run an obfuscated JavaScript payload, so its code could execute as part of installation rather than waiting for an application to import the SDK. Sonatype’s analysis says the installer launched the payload through Bun and could download Bun 1.3.13 when it was not already present. The code’s credential collection had little to do with the SDK’s stated work with sandboxes, repositories and cloud services.
Tensorlake’s advisory says the payload targeted GitHub and npm tokens, AWS and Google Cloud credentials, Kubernetes and Vault tokens, SSH and GPG keys, environment files, browser-saved passwords, cryptocurrency wallets and AI-tool and MCP configuration. Sonatype’s review names files associated with Claude, Cursor, Kiro, Codex, Gemini and Windsurf. The payload also polled a command channel and evaluated JavaScript supplied remotely, according to Sonatype.
Stolen access could reach other repositories
The advisory says the malware used stolen tokens to republish itself into other npm packages and repositories the victim could write to. Sonatype found code that could create a public GitHub repository and commit collected data there; one code path could include a stolen GitHub token in the uploaded data and commit message. Its analysis also found logic to add .claude and .vscode files to accessible repositories, potentially exposing other developers who later use them.
The advisory describes a persistent service called gh-token-monitor that deletes the user’s home directory if the stolen GitHub token is revoked. Tensorlake says users should remove that service before revoking tokens. The destructive behavior raises the stakes of the response: simply rotating credentials first could trigger the condition the malware was designed to exploit.
Confirmed reach remains narrower than the payload’s capabilities
Sonatype found that the install hook exits when it detects several specific CI environment markers, including certain GitHub Actions and GitLab CI variables. That behavior does not establish that CI systems were outside the attacker’s aims, and it does not show that every CI environment was spared. Tensorlake’s advisory tells teams to treat a machine or CI system as compromised if the version was installed with scripts enabled.
Neither the advisory nor Sonatype’s analysis confirms that collected data was published, repositories were modified or downstream systems were affected. The potential for those outcomes is not evidence that they occurred. Sonatype says it is continuing its investigation as additional components and impact are confirmed.
Tensorlake advises checking lockfiles and build logs
Tensorlake advises checking project dependencies for tensorlake@0.5.144 and platform-specific tensorlake-native-* packages at the same version, and reviewing build records for installations between 01:12 and 02:54 UTC on October 8. Its advisory identifies version 0.5.143 and earlier as unaffected and recommends moving back to 0.5.143, or to 0.5.145 once published at the time of the advisory.
For systems where the malicious version ran, the company recommends disconnecting the machine, removing the token-monitor service, then rotating accessible credentials from a separate clean machine. It also advises checking npm packages and repositories those credentials could publish to or modify, then rebuilding the affected machine from a trusted image. Removing the package alone cannot revoke credentials it may already have read.