tensorlake@0.5.144 npm Shai-Hulud worm with hostage GitHub token
› tensorlake (npm)
- started
- Oct 7, 2026
- closed
- ongoing
- CVEs
- 1
- sources
- 5
## summary
On Oct 8 2026, tensorlake@0.5.144 was published from the real GitHub repo (with npm provenance) carrying a preinstall hook that installs a Shai-Hulud-style credential-stealing worm. It harvests npm/GitHub/cloud/SSH/AI-tool secrets, spreads to other packages, and installs a “gh-token-monitor” that wipes the home directory if the stolen GitHub token is revoked. Pin 0.5.143; remove the monitor before rotating tokens.
severity: Critical supply-chain worm
## cve ids[1]
## affected
- 0.5.144
## fixed in
- 0.5.143 (safe pin); remove 0.5.144
## timeline[3]
0.5.144 published via the project’s release workflow.
StepSecurity / Socket detections and public write-ups; remediation guidance emphasizes removing gh-token-monitor before revoke.
Malicious commits land on tensorlakeai/tensorlake main.
## advisories[1]
## news & write-ups[1]
## posts[3]
Tensorlake npm Package Poisoned by the Shai-Hulud Worm, Credential-Stealing Payload Targeted AI Agent Infrastructure and Carried a “Hostage Token” That Triggers Destruction if Revoked On October 8, 2026, a malicious release of the tensorlake npm package, version 0.5.144, was
1/ npm: tensorlake@0.5.144 (Oct 8) shipped a Shai-Hulud-style worm in a preinstall hook. It hunts npm, GitHub and cloud creds plus .claude/.cursor configs. Treat the host as compromised. Socket: remove gh-token-monitor before revoking tokens, or it can wipe your home dir.
The Shai-Hulud worm infected the npm SDK of the AI platform Tensorlake. The malware steals credentials and can wipe home directories when tokens are revoked. dlvr.it/TVrLFR #Security #npm #ShaiHulud #Socket #Tensorlake - Follow for more t.co/mLg7PlLPhr
## notes & caveats
Still relevant mid-October because worm persistence and hostage-token behavior keep compromised developer machines at risk. Confirm whether 0.5.144 remains downloadable from npm before marking closed.
