Compromised tensorlake npm package delivers Shai-Hulud credential-stealing worm
The tensorlake TypeScript SDK was hijacked in a supply chain attack, with version 0.5.144 distributing malware that steals credentials and executes remote code.
Key points
- The compromised npm package is named "tensorlake" and is a TypeScript SDK.
- Malicious version 0.5.144 contains obfuscated malware linked to the Shai-Hulud worm.
- The malware harvests credentials, exfiltrates secrets, and establishes persistence.
The "tensorlake" package on the npm registry has been compromised, distributing a malicious version of the software development kit to developers. This supply chain attack, linked to the ChainDrop and Shai-Hulud threat groups, delivered a version of the package that installs credential-stealing malware.
According to The Hacker News, the compromised release is version 0.5.144 of the tensorlake package, which serves as a TypeScript SDK for Tensorlake applications, sandboxes, and cloud services. Security researchers at Socket identified the malicious code within this specific version. The malware is heavily obfuscated to evade detection, but its capabilities are significant and dangerous for any system that installs the package.
Malware Capabilities and Threat Context
The malicious code embedded in the tensorlake package performs several hostile actions upon installation. Socket reported that the malware harvests user credentials and exfiltrates secrets from the infected environment. Beyond data theft, the payload establishes persistence on the host system, ensuring it remains active even after reboots or attempts to remove it. Additionally, the malware is designed to execute remotely supplied code, effectively turning infected machines into botnet nodes or entry points for further lateral movement.
This incident is part of a broader campaign involving the ChainDrop and Shai-Hulud threat actors. These groups have been observed targeting software supply chains to distribute malware widely. By compromising a legitimate-looking SDK, attackers can reach a large number of developers and production environments through a single vector. The use of obfuscation techniques makes static analysis difficult, requiring dynamic analysis or behavioral monitoring to identify the malicious intent.
Who Is Affected
Developers and organizations that have installed version 0.5.144 of the tensorlake npm package are directly affected. This includes any project that lists tensorlake as a dependency and has pulled this specific version from the registry. Because npm packages are often nested within other dependencies, even indirect usage can lead to infection. Teams using Tensorlake applications, sandboxes, or cloud services that rely on this SDK should immediately audit their dependency trees. The risk extends to any build pipeline or development environment that automatically pulls dependencies without strict version pinning or integrity checks.
What should you do?
Security teams should immediately scan their environments for the presence of the compromised tensorlake package version 0.5.144. If found, the package should be removed, and systems should be checked for signs of credential theft or unauthorized code execution. Organizations should review access logs for any anomalous activity that may indicate exfiltration of secrets. Until a clean version is confirmed or an alternative is found, developers should avoid installing this package from the public npm registry.
What to do and how to stay safe: tensorlake
- Audit your npm dependency tree to identify if version 0.5.144 of the tensorlake package is present in your projects.
- Check for signs of persistence mechanisms and unauthorized processes on systems that may have installed the compromised package.
- Rotate any credentials, API keys, or secrets that may have been exposed on affected systems, as the malware is designed to harvest and exfiltrate them.
- Monitor network traffic for unusual outbound connections that could indicate the exfiltration of stolen data or the execution of remote commands.
Step-by-step guide: Social Engineering Warning Signs and How to Respond
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the specific version of the compromised tensorlake package?
The compromised version is 0.5.144 of the tensorlake npm package.
What does the malware in the tensorlake package do?
The malware harvests credentials, exfiltrates secrets, establishes persistence, and executes remotely supplied code.
Which threat actors are behind this attack?
The attack is linked to the ChainDrop and Shai-Hulud threat groups.
