# Tensorlake npm Package Compromised: A Worm With a Hostage Token That Wipes Your Machine If You Revoke It

Malicious tensorlake@0.5.144 npm release ran a preinstall hook stealing tokens, keys and browser logins, self-propagating via stolen npm/GitHub tokens, with a dead-man switch wiping home directories on token revocation.

- Payout: Real-world hack
- Severity: critical
- Program: Tensorlake
- Analysis by: StepSecurity
- Disclosed: 2026-10-08
- Write-up quality: 8/10
- Original: https://www.stepsecurity.io/blog/tensorlake-npm-compromised-hostage-token-worm
- Library page: https://bugbountylibrary.com/r/blog%3Astepsecurity-io-blog-tensorlake-npm-compromised-hostage-token-worm
- Tags: area:cloud domain:infra domain:oss impact:data-leak impact:integrity kind:incident platform:threat-intel sev:critical tech:ci-cd tech:github-actions tech:nodejs technique:source-review vuln:secrets-leak

**Target:** npm package preinstall hook (lib/setup.mjs loader, lib/Math_Symbol.js payload)
**Root cause:** Malicious commits pushed directly to main under a maintainer identity and released via the repo's own release workflow, so the package carried a valid npm provenance attestation despite containing an obfuscated credential-stealing worm.
**Steps:**
1. Malicious commits land on tensorlakeai/tensorlake main (e90c47b..6386121) with payload under typescript/lib/ and `"preinstall": "node lib/setup.mjs"` added to package.json.
2. Release workflow publishes tensorlake@0.5.144 at 01:12:07 UTC Oct 8; setup.mjs skips execution on CI, targeting developer machines.
3. setup.mjs downloads Bun and runs obfuscated lib/Math_Symbol.js (856 KB).
4. Payload harvests npm/GitHub tokens, AWS IMDS/ECS/Secrets Manager/SSM, Vault at `127.0.0.1:8200`, kubeconfigs, SSH keys, .env, browser logins, AI tool configs; encrypts and exfiltrates to a new public GitHub repo described "Shai-Hulud: Here We Go Again" or iseekaigogo.com.
5. With stolen npm token: downloads victim's packages, injects itself, bumps version, republishes with Sigstore provenance. With GitHub token: commits `.claude/settings.json` and `.vscode/tasks.json` as claude@users.noreply.github.com with message "chore: update dependencies".
6. Installs gh-token-monitor service polling api.github.com/user every 60s for up to 24h; on rejection runs `rm -rf ~/` (or PowerShell profile delete).
7. Remediation: stop/delete monitor service first (systemctl --user disable --now gh-token-monitor.service; launchctl bootout gui/$(id -u) ~/Library/LaunchAgents/com.user.gh-token-monitor.plist; delete ONLOGON task), then revoke tokens.
**How found:** StepSecurity's AI Package Analyst scored the tarball contents rather than reputation/provenance, flagging the release ~11 minutes after publication; Socket matched the setup.mjs/Math_Symbol.js structure to the earlier ChainDrop/Shai-Hulud keyv campaign.
**Exploitation:** Install-time execution via preinstall hook on developer workstations; payload resolves C2 through an Ethereum contract over ~30 public RPC endpoints with GitHub fallback, exfiltrates encrypted secrets to attacker-created public repos or iseekaigogo.com, and self-propagates by republishing victim npm packages and committing persistence files to victim repos. A background monitor holds the stolen GitHub token hostage: revocation triggers home-directory wipe.
**Escalation:** Credential theft chained into worm propagation across the victim's npm packages and GitHub repos, plus persistence via .claude/.vscode configs and a dead-man switch that destroys data if the token is revoked.
**Insight:** A valid npm provenance attestation only proves where a package was built, not that it is safe — malicious commits pushed straight to main and released by the project's own workflow inherit full provenance. Detect by diffing tarball contents and lifecycle scripts (preinstall/postinstall) against the prior version, and treat CI-skipping hooks as a signal the target is developer machines.

## Proof of concept (copied exactly from the original report)

**Preinstall hook launching malicious loader**

```
"preinstall": "node lib/setup.mjs"
```

**Linux removal of token monitor service**

```
systemctl --user disable --now gh-token-monitor.service
rm -rf ~/.config/gh-token-monitor ~/.local/bin/gh-token-monitor.sh ~/.config/systemd/user/gh-token-monitor.service
```

**macOS removal of token monitor launch agent**

```
launchctl bootout gui/$(id -u) ~/Library/LaunchAgents/com.user.gh-token-monitor.plist
```