VULNpocalypse
CriticalSupply chainPatch available

tensorlake 0.5.144 on npm carried a Shai-Hulud variant with a wiper, a browser wallet stealer and an Ethereum dead drop

tensorlake 0.5.144 on npm ran a Shai-Hulud variant at install that steals secrets and wallets and can wipe the host. Isolate before revoking tokens.

Published
Updated
Fixed in
0.5.144 is no longer on npm; 0.5.145 and later have no install script in registry metadata
Exploitation
Yes. 0.5.144 was published to npm on 8 October 2026 and is listed as malware in OSV and GitHub

What happened

On 7 October 2026 an attacker made verified commits under a tensorlake maintainer’s identity, adding the malicious code in commit 41b38f0 by direct file upload. About 20 hours later they triggered the npm publish (Aikido). The npm registry records tensorlake@0.5.144 as published at 01:12 UTC on 8 October 2026, and 0.5.145 at 20:24 UTC the same day (npm registry). The package’s repository is tensorlakeai/tensorlake.

OSV and GitHub list 0.5.144 as the only malicious version (MAL-2026-17650, GHSA-rqxj-g25x-4v9v). It is no longer served by npm. Aikido puts the package’s lifetime installs above 100,000 and found no sign the attacker published to PyPI or Cargo.

Aikido calls the payload a variant of the Shai-Hulud worm. A new WORMTAG marker and other differences point to a fresh compromise rather than reinfection from an earlier wave. For the wider family, see our Shai-Hulud advisory.

What the payload does

All details from Aikido.

  1. A preinstall script runs node lib/setup.mjs, which installs the Bun runtime and uses it to run lib/Math_Symbol.js, the obfuscated worm.
  2. It reads environment variables for cloud, CI (GitHub Actions, GitLab CI, CircleCI, Jenkins, Travis), Vault and Kubernetes, and files including ~/.ssh, ~/.aws/credentials, ~/.kube/config, ~/.docker, ~/.config/gcloud/legacy_credentials, ~/.config/github-copilot, GPG and TLS private keys, VPN configs, password manager stores, Signal and Telegram data, and desktop wallets (Exodus, Ledger Live, Electrum, Monero, Ethereum keystores).
  3. New in this wave: it copies IndexedDB and LevelDB data from 14 browser wallet extensions, including MetaMask, Phantom, Coinbase Wallet, Rabby, Trust Wallet and OKX, and downloads a HackBrowserData binary to pull saved browser credentials.
  4. It tries to spread to other packages the stolen tokens can publish.
  5. A dead man’s switch wipes the machine if an embedded GitHub token is revoked.
  6. It talks to iseekaigogo[.]com. As a fallback it reads Ethereum contract 0xb614155Fd88114d40549b259457Bcf921Df091B9 through eth.llamarpc.com, rpc.ankr.com and ethereum.publicnode.com to learn a new C2 address.

Am I affected?

bash
# Lockfiles
grep -nE 'tensorlake@0\.5\.144|tensorlake-0\.5\.144\.tgz' package-lock.json yarn.lock pnpm-lock.yaml bun.lock 2>/dev/null
grep -n -A2 '"node_modules/tensorlake"' package-lock.json 2>/dev/null | grep '"version": "0.5.144"'

# The resolved tree
npm ls tensorlake --all 2>/dev/null

# Payload files in any installed copy
find / -path '*node_modules/tensorlake/lib/*' \( -name setup.mjs -o -name Math_Symbol.js \) 2>/dev/null

Check any hit against the published hashes:

bash
shasum -a 256 $(find / -path '*node_modules/tensorlake/lib/*' \( -name setup.mjs -o -name Math_Symbol.js \) 2>/dev/null)
# lib/setup.mjs        25a0735d0db7dc40e5d45ce42d9c106067e6a66e184d967cfecfab17c3bcb5ef
# lib/Math_Symbol.js   b50a00900399ba99fb6ce1fc151519cb99d44320ef2a631f2237e1aea0ad6fec

Search DNS and proxy logs for iseekaigogo.com, and for calls to the three Ethereum RPC hosts from machines that have no reason to make them. Include CI runners and npx runs, which leave no lockfile.

What to do now

  1. Isolate first, revoke second. Take the machine offline and image it before revoking GitHub tokens, so the wiper cannot destroy evidence or data (Aikido).
  2. Rotate everything on the host, from a clean machine: npm and GitHub tokens, cloud and Kubernetes credentials, Vault tokens, SSH and GPG keys, Docker credentials and CI secrets. Aikido rates this the critical priority.
  3. Move crypto funds. Any wallet whose extension data or keystore was on the host should be treated as exposed. Create new wallets on a clean device and transfer funds.
  4. Reset browser-saved passwords on the host, since the HackBrowserData step targets them.
  5. Reinstall cleanly. Remove node_modules, pin tensorlake to a version other than 0.5.144 in your lockfile and run npm ci. Registry metadata shows no install scripts for 0.5.143 or 0.5.145 (npm registry).
  6. If you publish npm packages from that machine, check your packages for versions you did not release after 8 October 2026.

Sources