AI agent infrastructure hit as well: official TensorLake npm package poisoned

On 8 October, a malicious version (0.5.144) was published to the official npm package of TensorLake, an open-source AI agent infrastructure project. Once installed, credentials for npm, GitHub, AWS, and Vault could be harvested and exfiltrated within seconds. It took only about 11 minutes from the malicious commit entering the main branch to its release and subsequent discovery by researchers.

Key Takeaways

1. The malicious payload is a Mini variant of the Shai-Hulud family, executed via a preinstall script across developer terminals, CI environments, Kubernetes, and cloud environments.
2. It steals npm tokens, GitHub personal access tokens, AWS/GCP/Azure cloud keys, and HashiCorp Vault credentials.
3. This marks the third large-scale intrusion by this family: keyv/cacheable and @antv (which impacted echarts-for-react, with millions of weekly downloads) were previously poisoned.
4. Direct alert for enterprises: Official package registries do not guarantee security; dependency origin verification, artifact repository gating, and key rotation must be implemented proactively.

1. What Happened

TensorLake is an open-source AI agent infrastructure project whose npm package garners around 12,000 downloads per week. At 01:20 UTC on 7 October, a malicious commit made under the guise of a maintainer entered the main branch of tensorlake-ai/tensorlake; on 8 October, version 0.5.144 of the eponymous npm package was published from the same repository, bearing an obfuscated malicious payload.

2. Shai-Hulud: The "Contagious" Credential-Stealing Worm

The malicious version uses a preinstall script as its entry point: when a developer runs npm install, the script executes, and the obfuscated bun payload takes over. Rather than stealing credentials in a one-off breach, it replicates itself and spreads laterally, leading security vendors to define it as a "credential-stealing worm".

Even more alarming is its "hostage token" mechanism: attackers use the stolen publish tokens as triggers. If a victim revokes the token, it can trigger a wipe routine that destroys local data. Researchers warn that conventional remediation steps—uninstalling the malicious package, pinning clean versions, and rotating keys—will leave machines compromised if configuration files in AI coding assistant directories are not cleaned up simultaneously.

3. Why the AI Supply Chain Has Become a Target

Active since September 2025, the Shai-Hulud family has evolved its tactics from npm typosquatting to directly compromising legitimate maintainer accounts and poisoning official packages. Three distinct characteristics make it a benchmark case of supply chain attacks:

1

Forging the Software Signing Chain

The family previously extracted GitHub Actions OIDC tokens to obtain valid Sigstore signing certificates, causing malicious packages to appear to automated tools as having passed SLSA Level 3 verification.

2

Using AI Coding Assistant Configs for Persistence

Directories like .claude/ and .vscode/ are commonly excluded by .gitignore and rarely audited. Malicious code concealed here cannot be removed simply by uninstalling the package.

3

Developer Environments House High-Value Credentials

A single developer machine often stores cloud keys, CI tokens, and code repository privileges simultaneously; compromising one developer is equivalent to seizing the entire release pipeline.

4. Enterprise Defense: A 5-Step Actionable Checklist

1

Check Whether 0.5.144 Has Been Installed

Run npm ls tensorlake to verify if lockfiles pin 0.5.144; check whether the tensorlake main branch has been cloned or pulled since 7 October.

2

Fully Rotate Affected Credentials

Rotate all npm tokens, GitHub PATs, cloud keys, and Vault credentials; be aware of the "hostage token" mechanism and isolate contaminated machines prior to revocation.

3

Clean AI Coding Assistant Configuration Directories

Inspect directories excluded by .gitignore, such as .claude/ and .vscode/, to look for anomalous scripts and configurations—do not stop at merely uninstalling the package.

4

Turn Artifact Repositories into Enforced Gateways

Route all third-party dependencies through internal artifact repositories (e.g. Nexus, JFrog) and block poisoning attempts between the external open-source ecosystem and internal registries, stopping malicious packages from entering the build pipeline.

5

Monitor Anomalous Exfiltration from CI and Cloud Environments

Configure whitelisting and alerting for outbound network connections from CI pipelines, focusing on monitoring credential file access, encrypted exfiltration, and suspicious processes, turning "instant compromise upon install" into a detectable event.

5. What Cyritex Can Do

The TensorLake incident highlighted two core vulnerabilities: untrusted dependency sources and a lack of visibility after credentials are stolen. The Cyritex product suite provides targeted capabilities to address both gaps.

Official packages, signature verification, version pinning—defenses that were once sufficient must now be reassessed after attackers have learned to forge signing chains. Securing dependency entry points and gaining full visibility over credential exfiltration are currently the two most cost-effective actions to take.

References

[1] The Hacker News, "Tensorlake npm Package Compromised to Deliver Shai-Hulud Credential-Stealing Worm", 2026-10-08
[2] Endor Labs, "Tensorlake npm package compromised by Shai-Hulud", 2026-10-08
[3] StepSecurity, "Tensorlake npm Package Compromised: A Worm With a Hostage Token", 2026-10-08
[4] SafeDep, "tensorlake 0.5.144 npm Compromise Ships Mini Shai-Hulud", 2026-10-08
[5] Cloud Security Alliance, "Mini Shai-Hulud: npm Worm Targets AI Developer Supply Chain", 2026-05