# TensorLake npm SDK published a credential stealer in 0.5.144

> Installing one version of the TensorLake npm SDK was enough to hand over npm, GitHub, AWS, Vault and Kubernetes credentials.

- **Severity:** High: A working attack on a widely used AI product or ecosystem. A fix may exist. Patch or mitigate this week.
- **Category:** Supply chain, Incident
- **Published by:** Socket
- **Disclosed:** 2026-10-08
- **Affects:** tensorlake (npm)
- **Research by:** Socket Research Team
- **Primary source:** https://socket.dev/blog/tensorlake-compromise
- **Page:** https://theinjection.dev/items/socket-tensorlake-npm-credential-stealer/

tensorlake 0.5.144 on npm carried a credential-stealing worm that runs from a preinstall hook, Socket reports. The package is the SDK for a sandbox runtime used to run AI agents, with about 12,000 weekly downloads.

## What happened

Socket reported on October 8, 2026 that tensorlake 0.5.144 was published to npm at 01:12:07 UTC that day with malicious code, and that Socket flagged it about eleven minutes later. Socket links the payload to the ChainDrop and Shai-Hulud compromises of keyv, cacheable and related packages in August 2026.

## How it works

A preinstall hook runs an obfuscated loader that launches the payload with Bun, so no import or agent start is needed. The payload is both a credential stealer and a self-propagating worm: it republishes compromised versions of packages tied to the victim's publishing identity with Sigstore provenance, and plants fake Copilot and Dependabot GitHub Actions workflows. Socket reports it has no hardcoded command-and-control domain and instead resolves its endpoint through an Ethereum contract, with a GitHub fallback.

## Who is affected

Anyone whose install of tensorlake resolved to 0.5.144, in a developer environment or a CI job. Socket gives the package about 12,000 weekly downloads overall and notes that figure is not a count of infections. The underlying project is a serverless runtime that provides Firecracker sandboxes for running agents and untrusted code.

## What to do

Block tensorlake 0.5.144 and search manifests, lockfiles, build logs and deployed artifacts for it, then treat any host where its install scripts ran as compromised. Socket warns that you must stop and delete the gh-token-monitor persistence before revoking any credentials, because revoking the stolen GitHub token first can trigger a destructive handler.

## Quick facts

- **Package:** tensorlake (npm)
- **Malicious version:** 0.5.144, published 01:12:07 UTC on October 8, 2026
- **Detected:** About 11 minutes after publication, by Socket
- **Campaign:** ChainDrop / Shai-Hulud
- **Targets:** npm, GitHub, AWS, HashiCorp Vault and Kubernetes credentials, SSH keys, .env files, AI tool configurations
- **Persistence:** gh-token-monitor, with a dead-man handler if the stolen token is revoked
- **Found by:** Socket Research Team

## Questions

### Which tensorlake version is malicious?

tensorlake 0.5.144 on npm is the malicious version, published at 01:12:07 UTC on October 8, 2026. Socket flagged it about eleven minutes later. Socket advises blocking that exact version and checking manifests, lockfiles, build logs, and deployed artifacts for it. Other tensorlake releases are not named as compromised in Socket's write-up.

### Should I revoke my GitHub token right away after a tensorlake infection?

Socket warns against revoking tokens first. The payload installs a persistent monitor that polls GitHub with the stolen token and runs an attacker-supplied handler if the token is revoked. Socket advises stopping and deleting the gh-token-monitor persistence before revoking anything: a systemd user service on Linux, a LaunchAgent on macOS, or an ONLOGON scheduled task on Windows.

### What credentials does the tensorlake payload steal?

Socket reports that the payload targets npm, GitHub, AWS, HashiCorp Vault, and Kubernetes credentials, along with SSH keys, .env files, crypto wallets, messaging app data, and AI tool configurations. Socket also says the payload republishes compromised versions of packages tied to the victim's publishing identity with Sigstore provenance, and plants fake Copilot and Dependabot workflows in GitHub repositories.

## Sources

1. [Socket Write-Up](https://socket.dev/blog/tensorlake-compromise)
2. [TensorLake Repo](https://github.com/tensorlakeai/tensorlake)