tensorlake 0.5.144 on npm - A Shai-Hulud Worm Variant That Plants Claude Code Hooks and Wipes the Machine if You Revoke Its Token
On October 8, 2026, the npm package tensorlake, the TypeScript SDK for the Tensorlake data platform, shipped a version that was not written by its maintainers. 0.5.144 carried a variant of the Shai-Hulud worm, the self-replicating credential stealer behind the keyv and cacheable compromise in August and, before that, the second Shai-Hulud wave. It does what its ancestors did: steals developer credentials at install time, republishes itself through the victim's npm account, and writes itself into Claude Code and VS Code configuration so it runs again later. It adds one thing: a wipe switch tied to the stolen GitHub token, aimed squarely at the first step of every incident runbook.
This advisory is built from the npm registry's own records, which we checked directly, and from the analyses published by Socket, StepSecurity, Aikido, OX Security and The Hacker News, which agree with each other on every point that matters. Where a detail comes from one vendor we say so.
What happened
Per Socket's reconstruction, the attacker had write access to the project's GitHub repository. The Hacker News places the first rogue commit at 01:20 UTC on October 7. About a day later the repository's own release workflow built and published 0.5.144 to npm. The registry records the publish at 01:12 UTC on October 8. The version has since been unpublished, which is why it no longer appears in the package's version list while its timestamp remains. 0.5.145 followed at 20:24 UTC the same day. The registry shows normal build scripts on 0.5.143 and none on 0.5.145, which is consistent with a rebuilt release that drops the compromised lifecycle hook.
Execution came from a preinstall script. Per Socket, the hook launches the malware during npm install, before the project runs a line of its own code, and whether or not it ever imports the library. One analysis says the first stage downloads the Bun runtime to execute the main payload, the same self-contained-runtime technique the August wave used so that the host's Node environment is irrelevant. The campaign is attributed by the analysing vendors to ChainDrop, the Shai-Hulud operation first documented in early August 2026 in connection with the compromise of hundreds of npm packages.
What the payload does
- Credential theft. npm and GitHub tokens, cloud provider and SSH keys, Kubernetes and Vault secrets, browser data, and AI tool configuration files. Every vendor lists the same categories.
- Self-propagation. With a stolen npm token it downloads the victim's own packages, adds itself, bumps the version and republishes. One compromised maintainer becomes many compromised packages without the attacker touching a keyboard.
- Agent persistence. Per StepSecurity, it writes
.claude/settings.jsonand.vscode/tasks.jsoninto repositories it can reach, so the payload is re-launched when a developer opens the project in Claude Code or VS Code. One report says the files are committed to GitHub repositories under a Claude-branded identity, so the change looks like routine agent housekeeping in a log. OX Security lists.claude/settings.jsonamong its indicators of compromise. - Dead-man switch. A
gh-token-monitorprocess watches the stolen GitHub token. If the token is revoked while the monitor is running, the malware wipes the home directory. Every vendor advisory carries the same instruction: remove the monitor before rotating credentials.
Remediation, in the right order
- Find every install of 0.5.144. Search lockfiles, CI caches and container layers across the organization for the version, not just the package name. The window is October 8, roughly 01:12 to 20:24 UTC, but a cached tarball can replay later.
- Isolate affected hosts and runners first. Do not touch credentials yet.
- Stop and remove the token monitor (reports name it
gh-token-monitor) and any scheduled service that restarts it. Image the host first if you need evidence. - Then rotate everything it could read: GitHub and npm tokens, cloud keys, SSH keys, Kubernetes and Vault credentials, browser-stored sessions. Revoke, do not just regenerate.
- Check what was published under your npm identity. Look for unexpected versions of your own packages in the window, unpublish them and notify downstream users.
- Audit every repository the host could reach for a
.claude/settings.jsonhook or a.vscode/tasks.jsontask you did not write, and remove them. Rebuild the host rather than cleaning it.
Why the agent-config persistence is the part that outlives the incident
Dependency remediation is good at packages and blind to everything else. A lockfile pin resolves the malicious package. It does not revoke a token, it does not retract a republished package, and it does not remove a hook that was written into a repository and that a coding agent, not a package manager, will read. We explained how Claude Code hooks work: they are configuration that runs a command at an event, and a repository can carry them. The August wave planted a SessionStart hook and a folderOpen task; this wave writes the same two files. Workspace-trust prompts in both tools reduce the risk of the hook firing in a fresh clone, and do nothing about the clone on which the preinstall script already ran.
The wipe switch is the clearest sign yet that these campaigns are written with the defender's runbook open. Revoke the token and you lose the machine. That makes knowing which machines are affected before you act the whole game, and it makes the inventory question concrete: which endpoints installed the package, which of them now carry a hook they did not have last week, and which repositories those hooks point at. For the broader pattern of install-time payloads aimed at developers, see our defender's guide to AI supply-chain attacks and the Miasma phantom-gyp worm, which also spread through a build hook.
How Anomity surfaces and governs it
See it. The Anomity Endpoint Sensor inventories the AI artifacts on every managed machine, including the hooks declared in Claude Code settings and the settings files that declare them, each with a first-seen time. A .claude/settings.json hook that appeared on forty laptops on October 8 is one query, and the answer is a list of hostnames rather than a fleet-wide hunt after the SCA report has already gone green. Metadata only; secrets are redacted on the endpoint.
Enforce before the call runs. On agents that expose a pre-execution hook, such as Claude Code PreToolUse, Anomity evaluates each tool call against policy and returns allow, deny or log before it runs. A session-start command that spawns an unexpected process or reads a credential file is denied at the boundary, which is the control that still applies on the day somebody clicks Trust on a clone the worm touched. Keep the record. Configuration changes and policy decisions land in a 90-day audit trail and route to SIEM, Slack, email or Jira. Anomity is SOC 2 Type II and complements SCA, EDR, DLP and network tooling at the AI-artifact layer; it does not replace them.
Shai-Hulud has now come back four times on the same primitive: one write-capable account, one install hook, and a registry that runs code before anyone reads it. Each wave spends a little more of its effort on the AI coding tools on the developer's machine. If you want to know which of your endpoints carry agent hooks they did not have a week ago, book a 30-minute demo.
Frequently asked questions
Which tensorlake versions are affected?
Only 0.5.144 on npm. The registry shows it published on October 8, 2026 at 01:12 UTC and now unpublished, with 0.5.143 published on October 6 and 0.5.145 published at 20:24 UTC on October 8. Reports say the PyPI and Cargo distributions of tensorlake were not affected. If a lockfile anywhere in your organization resolved to 0.5.144 during that window, treat the machine or runner that installed it as compromised.
What does the payload do?
The vendor analyses we have read agree on the outline. A preinstall hook runs during npm install and launches the payload, which one analysis says downloads the Bun runtime to execute its main stage, the same technique as the August wave. It collects npm and GitHub tokens, cloud provider and SSH keys, Kubernetes and Vault secrets, browser data and AI tool configuration files. With a stolen npm token it downloads the victim's own packages, adds itself, bumps the version and republishes them. StepSecurity reports it also writes Claude Code and VS Code configuration into reachable repositories so it is re-launched when the project is opened.
Why is the order of remediation so important this time?
Because of the wipe switch. The malware leaves a monitor process watching the GitHub token it stole. If that token is revoked while the monitor is still running, the malware deletes the home directory. Revoking credentials first is the reflex every incident runbook trains, and here it is the trigger. Isolate the host, stop and remove the monitor, image the machine if you need evidence, and only then rotate the GitHub token and everything else it collected.
We ran npm audit and it is clean. Are we done?
No. npm audit and lockfile tooling resolve the malicious package. They do not revoke the tokens that already left, they do not find the packages the worm republished under your npm identity, and they do not remove the hook the worm wrote into a .claude/settings.json or the task it wrote into a .vscode/tasks.json. Those files live in repositories, survive a version bump, and are read by a coding agent or an editor rather than by a package manager.
Is this the same campaign as the keyv and cacheable compromise in August?
The vendors analysing it attribute it to the same lineage, the Shai-Hulud worm family and the ChainDrop campaign that was first documented in early August 2026 with the compromise of hundreds of npm packages including keyv and cacheable. The techniques match: a preinstall hook, a self-contained runtime, credential theft, npm self-propagation and persistence in AI coding-agent configuration. The wipe tied to token revocation is the addition.
How does Anomity help with this?
The Anomity Endpoint Sensor inventories the hooks declared in Claude Code settings on every managed machine, with a first-seen time, so the question of which endpoints still carry agent configuration this worm wrote is a query rather than a hunt. On agents that expose a pre-execution hook, such as Claude Code PreToolUse, Anomity can allow, deny or log a call before it runs. Decisions and configuration changes land in a 90-day audit trail that routes to SIEM, Slack, email or Jira. Anomity complements your SCA, EDR and DLP tooling at the AI-artifact layer; it does not replace them.
