# TensorLake npm SDK Compromised in ChainDrop Shai-Hulud Credential-Stealing Attack

Compromised tensorlake npm SDK 0.5.144 shipped a preinstall hook that ran a Shai-Hulud worm stealing npm, GitHub, AWS, Vault and Kubernetes credentials.

- Payout: Real-world hack
- Severity: critical
- Program: Tensorlake
- Analysis by: Socket Research Team
- Disclosed: 2026-10-08
- Write-up quality: 7/10
- Original: https://socket.dev/blog/tensorlake-compromise
- Library page: https://bugbountylibrary.com/r/blog%3Asocket-dev-blog-tensorlake-compromise
- Tags: area:oss domain:oss impact:data-leak impact:integrity kind:incident platform:threat-intel sev:critical tech:aws tech:github-actions tech:kubernetes tech:nodejs technique:source-review vuln:secrets-leak

**Target:** npm package (tensorlake SDK) install lifecycle
**Root cause:** Attacker gained maintainer-level access to the tensorlake GitHub repo and published version 0.5.144 containing a `preinstall` hook that executes an obfuscated loader and worm payload during npm install.
**Steps:**
1. Attacker made verified commits under a maintainer identity in the tensorlake GitHub repo on 2026-10-07, introducing malware via commit `41b38f0` (direct file upload).
2. Published tensorlake@0.5.144 on 2026-10-08 01:12:07 UTC with manifest hook `"preinstall": "node lib/setup.mjs"`.
3. On install, `lib/setup.mjs` drops Bun and executes `lib/Math_Symbol.js` with the Bun runtime.
4. Payload sets a global `WORMTAG` marker, decrypts persistence/proliferation payloads, and harvests credentials from env vars, `.npmrc`, IMDS/ECS/Secrets Manager/SSM, Vault at `127.0.0.1:8200`, kubeconfigs, SSH keys, `.env`, wallets, and AI tool configs (`.claude`, `.cursor`, `.kiro`, Windsurf, Zed).
5. Resolves C2 via Ethereum contract `0xb614155Fd88114d40549b259457Bcf921Df091B9` read through public RPCs, with hardcoded `iseekaigogo[.]com` as the resolved value.
6. Installs a `gh-token-monitor` persistence (systemd user service / LaunchAgent / ONLOGON scheduled task) that polls `api.github.com/user` and runs an attacker handler via `Invoke-Expression` when the token is revoked.
7. Worm enumerates packages under the victim's publishing identity, builds Sigstore provenance, and republishes compromised versions; plants fake Copilot/Dependabot GitHub Actions workflows.
**How found:** Socket's package monitoring flagged the new release ~11 minutes after publication; the preinstall hook and `setup.mjs`/`Math_Symbol.js` filenames matched the earlier ChainDrop/Shai-Hulud keyv and cacheable compromises, and the `WORMTAG` marker indicated it as a novel compromise rather than ongoing reinfection.
**Exploitation:** Anyone running `npm install tensorlake@0.5.144` on a dev workstation, CI runner, or build server executes the preinstall hook with the installer's permissions, giving the worm access to all secrets in that environment; stolen npm/GitHub tokens enable supply-chain propagation to downstream packages.
**Escalation:** Stolen publishing credentials + Sigstore provenance allow republishing compromised versions of other packages; dead-man switch wipes home directory if the stolen GitHub token is revoked before removing persistence.
**Insight:** Shai-Hulud variants reuse identical filenames (`lib/setup.mjs`, `lib/Math_Symbol.js`) and a `preinstall` hook — grep lockfiles and package manifests for these artifacts and for `WORMTAG`; also check for `gh-token-monitor` persistence before rotating any stolen GitHub token, since revocation triggers a wiper.

## Proof of concept (copied exactly from the original report)

**Malicious preinstall hook in package manifest**

```
"preinstall": "node lib/setup.mjs"
```

**Ethereum contract C2 resolver call**

```
0xb614155Fd88114d40549b259457Bcf921Df091B9 through eth.llamarpc.com, rpc.ankr.com and ethereum.publicnode.com to retrieve an alternative C2/exfiltration domain. The most recent update to the contract, made on 21 September from the wallet 0x779f83aE56309682beDb04816c19d358c4B21040, sets this value to the same hardcoded C2 address, iseekaigogo[.]com.
```

**Persistence removal commands for token monitor**

```
Linux: systemctl --user disable --now gh-token-monitor.service and remove ~/.config/gh-token-monitor/
- macOS: unload ~/Library/LaunchAgents/com.user.gh-token-monitor.plist
- Windows: delete the ONLOGON scheduled task running monitor.ps1
```