Loading story…
The npm package tensorlake version 0.5.144 was compromised with install-time malware that steals developer credentials and browser data and attempts to spread through npm packages and GitHub repositories. StepSecurity reported that malicious commits were pushed directly to tensorlakeai/tensorlake under a maintainer identity, after which the repository’s release workflow published the package with a valid npm provenance attestation. Aikido identified the payload as a Shai-Hulud worm variant and assessed it as likely a new compromise rather than reinfection from an earlier wave. The malware skips CI environments, targets developer machines, and establishes persistence through Claude Code and VS Code configuration files. It exfiltrates encrypted secrets through attacker-created public GitHub repositories or iseekaigogo.com, with command-and-control discovery using Ethereum transaction data.
A background service named gh-token-monitor checks a GitHub token every 60 seconds for up to 24 hours and deletes the user’s home directory if GitHub rejects the token, making credential revocation potentially destructive while the monitor remains active. Affected organizations should remove the monitor before revoking credentials, treat infected systems as fully compromised, and then urgently rotate exposed credentials. StepSecurity recommends pinning tensorlake to 0.5.143 and investigating repository modifications and other propagation indicators. Aikido found no evidence of malicious publishing to PyPI or Cargo. The compromised release demonstrates that valid package provenance can accompany malicious code when the source repository and its authorized release path are compromised.
Trace attribution and downstream blast radius.
12 events from the most recent confirmed update back to the earliest known activity.
Socket flagged tensorlake@0.5.144 at 01:23:10 UTC, approximately 11 minutes after publication. Its analysis linked the malware to ChainDrop/Shai-Hulud through similarities in payload filenames, Ethereum-based endpoint resolution, and token-monitoring code seen in earlier compromises.
The repository's release workflow published tensorlake@0.5.144 at 01:12 UTC under the same maintainer identity. The release contained the malicious repository files and carried a valid npm provenance attestation despite containing malware.
Seven additional commits followed over the next few hours, modifying the payload and adding a preinstall hook to package.json. Aikido identified direct malware upload in commit 41b38f0, followed by attempts to bump versions and trigger publication.
The first malicious commit reached tensorlakeai/tensorlake's main branch at 01:20 UTC under a maintainer's identity. The attacker pushed directly to the repository without using a pull request.
Sonatype Research Labs identified a fallback capable of creating a public GitHub repository and uploading collected data under results/, including a stolen GitHub token in the data and commit message under specific conditions. The report did not confirm successful publication of stolen data, repository modification, or downstream compromise.
Tensorlake withdrew the compromised npm SDK release, version 0.5.144, and updated the SDK to version 0.5.145.
OX Security reported that five GitHub repositories containing stolen credentials had been uploaded following the Tensorlake attack. Researchers also identified previously unseen encryption keys, suggesting possible reuse by another operator but not confirming attribution.
The compromised tensorlake@0.5.144 release was reported as no longer available for download from the npm registry. Users who installed it were advised to remove it immediately and rotate their credentials.
GMO Flatt researchers reported Windows persistence through an ONLOGON scheduled task and enumeration of AWS SSM Parameter Store and Secrets Manager across all regions. They also published artifact hashes and network indicators, while cautioning that the investigation remained preliminary.
StepSecurity and Aikido disclosed install-time credential theft, npm and GitHub propagation, editor-based persistence, browser-data collection, and blockchain-based command-and-control resolution. StepSecurity identified a gh-token-monitor service that deletes the user's home directory if GitHub rejects the monitored token, warning users to remove it before revoking credentials.
StepSecurity's AI Package Analyst detected tensorlake@0.5.144, and StepSecurity reported the compromise to maintainers through GitHub issue #1014.
An Ethereum transaction dated September 21 contained iseekaigogo[.]com in its input data. Aikido identified it as the latest transaction used by the malware's blockchain-based command-and-control lookup; the transaction's year was not stated.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 13 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
14 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcesonatype.com
Open sourcethecybersecguru.com
Open sourcetheregister.com
Open sourcesocket.dev
Open sourceflatt.tech
Open sourcegithub.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers linked by multiple researchers to **TeamPCP** hijacked the npm maintainer account `atool` and used it to publish roughly **639 malicious versions across 323 packages**, heavily impacting Alibaba’s **`@antv/*`** ecosystem as well as packages such as `echarts-for-react`, `timeago.js`, and `size-sensor`. Reports said the malware executed through malicious `preinstall` hooks and an obfuscated Bun-based payload, stealing secrets from developer workstations and CI/CD systems including GitHub, npm, AWS, Kubernetes, Vault, SSH, Docker, and database credentials. The campaign also abused GitHub tokens to create attacker-controlled repositories for exfiltration, scraped GitHub Actions runner memory for plaintext secrets, and in some cases targeted trusted tooling including a briefly compromised **Nx Console** VS Code extension. Researchers said the operation was worm-like and self-propagating, using stolen npm tokens to tamper with and republish additional packages under legitimate maintainer identities, with the broader **Mini Shai-Hulud** activity now tracked across npm, PyPI, and Composer. The malware reportedly established persistence in developer environments through modified VS Code and Claude Code settings and OS-level services, while some reports warned it also attempted to forge valid **Sigstore/SLSA provenance** using stolen CI identities. In response, **npm invalidated all write-enabled granular access tokens that bypassed two-factor authentication** and introduced **Staged Publishing** in preview, but researchers warned that any machine or pipeline that installed affected versions should be treated as fully compromised and all reachable credentials rotated immediately.
Jun 29, 2026
Compromised releases of the AI memory-integration package `@memtensor/memos-cloud-openclaw-plugin` on npm and `MemoryOS` on PyPI distributed the multiplatform Go-based **Sckit** worm, also tracked as `supplychain.local`. Affected npm versions include `0.1.21`, `0.1.23`, and `0.1.25`; the PyPI package was affected from version `2.0.34`. The payload executes when affected functionality is invoked—including agent-gateway startup and memory-recall events—rather than during installation, launching detached Windows, Linux, or macOS binaries across x86 and ARM systems. It inherits the host environment and can receive recalled prompts in `SCKIT_EVENT_TEXT`, potentially exposing credentials and sensitive prompt data available to the process. The malware is designed to inventory user home directories and steal credentials for cloud providers, source-control services, package registries, AI platforms, and business applications. Its suspected objectives include compromising GitHub repositories and CI environments, planting self-executing GitHub Actions or package hooks, and republishing through npm and PyPI; however, investigators had not confirmed successful exfiltration, propagation, persistence, or public repositories containing its propagation stubs. The rapid alternation of malicious and clean npm releases indicates that the publisher account and release environment may have been compromised. Suspected command-and-control infrastructure includes `skyleen.fr` domains resolving to `139.84.223.178`; version `0.1.25` also added a Linux CA-certificate fallback, likely to improve outbound HTTPS connectivity.
Sep 24, 2026
A large software supply-chain campaign dubbed **Mini Shai-Hulud** compromised more than 170 npm packages and at least two PyPI packages tied to projects including **TanStack, Mistral AI, OpenSearch, UiPath, Guardrails AI,** and others. Researchers and vendors attributed the activity to **TeamPCP**, saying the attackers abused GitHub Actions release workflows—especially `pull_request_target`, cache poisoning, and theft of short-lived **OIDC** material from runners—to publish trojanized packages with apparently legitimate **SLSA** provenance, Sigstore attestations, and trusted-publishing signatures. Reports variously counted between roughly 160 and 400+ malicious package versions, with some affected packages totaling hundreds of millions of downloads, and OpenSearch and Mistral both confirmed compromised releases while TanStack described a chained workflow attack on its publishing pipeline. The malware targeted developer workstations and CI/CD systems, stealing **npm**, **GitHub**, cloud, Kubernetes, Vault, SSH, Docker, and AI-tool credentials, then attempting worm-like propagation by republishing infected packages with stolen tokens or workflow-issued publish credentials. Investigators said the payload also established persistence through **VS Code** tasks, **Claude Code** hooks, and in some cases system services, while exfiltrating data through **Session**, GitHub dead drops, and other attacker infrastructure; some variants included extortion notes, dead-man-switch logic, and geofenced destructive behavior. Defenders were urged to treat hosts that installed affected versions as potentially fully compromised, remove persistence before revoking tokens where applicable, rotate all exposed secrets from clean systems, invalidate CI caches, audit lockfiles and publishing activity, and rebuild impacted environments from trusted sources.
Jul 12, 2026