The Pulse
Tensorlake npm SDK Version 0.5.144 Carried Shai-Hulud Malware
Aikido says Tensorlake’s npm package version 0.5.144 was published with a Shai-Hulud worm variant on October 8, 2026. The malware runs during installation, targets developer secrets and attempts to spread through connected software accounts
AI.info Team · Written with AI ·
Any system or environment infected by the malware should be treated as fully compromised and any secrets or credentials it contained should be rotated as a critical priority.
Oliver Smith, Aikido
A malicious release of Tensorlake’s npm package put a Shai-Hulud worm variant inside the TypeScript SDK, where it could run as soon as developers installed it. Aikido reported the compromised version, tensorlake@0.5.144, on October 8, 2026. The package’s install hook launched an obfuscated script that sought credentials and other secrets, then attempted to spread through connected developer accounts.
The GitHub Advisory Database identifies version 0.5.144 as affected and warns that a computer that installed or ran it should be considered fully compromised. The advisory says removing the package alone may not eliminate malicious software left behind.
A preinstall hook put the payload in motion
Aikido says the package’s preinstall script ran lib/setup.mjs, which dropped the Bun runtime and used it to execute a second obfuscated file, lib/Math_Symbol.js. Because the trigger was part of installation, the malicious code did not need to wait for an application to call the SDK’s functions. The report lists SHA-256 hashes for both files to help teams check systems and package copies.
The payload targeted environment variables and local files associated with cloud accounts, CI services, SSH, Kubernetes, Vault, developer tools and cryptocurrency wallets. Aikido also found attempts to collect browser-extension data and use a remote browser-data tool to seek more credentials. The report describes the malware as a Shai-Hulud variant that both exfiltrates secrets and attempts to replicate across software supply chains.
Attacker activity reached Tensorlake’s GitHub repository
Aikido traced the malicious files to Tensorlake’s GitHub repository. It says commits made under a maintainer’s identity introduced the malware on October 7, and the repository remained compromised for about 20 hours before the attacker triggered the npm publication. That timeline points to the project’s source repository as part of the incident, rather than a malicious package that merely borrowed Tensorlake’s name.
Aikido reported more than 100,000 lifetime installs for the Tensorlake npm package. That figure describes the package’s reported cumulative reach; it does not establish how many developers installed version 0.5.144. Aikido also said Tensorlake distributes packages through PyPI and Cargo, but it had found no evidence at publication time that the attacker had released compromised versions through those registries.
Exposure extends beyond the package itself
The worm’s value to an attacker lies in the credentials available on an infected machine. A stolen npm token can expose packages a developer can publish; GitHub credentials can open access to repositories; cloud and CI secrets may grant access to deployment systems. Aikido also describes a destructive safeguard that can wipe an infected machine if an embedded GitHub token is revoked, complicating the usual response of immediately disabling exposed credentials.
GitHub’s advisory urges affected users to rotate secrets from a different computer and treats the host as compromised, not simply as a package to uninstall. The incident’s concrete exposure is narrow in version terms—tensorlake@0.5.144—but its potential reach depends on the credentials and systems accessible wherever that release ran.