Hostage Token: Shai-Hulud Hijacks Tensorlake's npm SDK

Red | Attack

Shai-Hulud Worm Hijacks Tensorlake npm SDK 0.5.144 with Hostage Token Dead-Man's Switch | Hive Pro Threat Advisory

Threat Advisory/Attack Report/TA2026294

Hostage Token: Shai-Hulud Hijacks Tensorlake's npm SDK

A maintainer-identity push let the project's own release pipeline publish tensorlake 0.5.144 carrying a Shai-Hulud worm variant with a dead-man's switch.

Shai-Huludtensorlake 0.5.144npm supply chainDead-man's switchCI/CDWorldwide

Published

October 09, 2026

Admiralty code

TA number

TA2026294

First seen

October 7, 2026

Report type

Attack

Malware

Shai-Hulud

Package

tensorlake 0.5.144

Platforms

Windows, Linux, macOS

Regions

Worldwide

01 / Overview

Summary

First seen: October 7, 2026
Targeted regions: Worldwide
Targeted platforms: Windows, Linux, macOS, npm ecosystem, CI/CD pipelines, Kubernetes, Cloud environments
Targeted industries: Software Development, Artificial Intelligence, Technology
Malware: Shai-Hulud

A threat actor pushed malicious code into the tensorlakeai/tensorlake GitHub repository using a maintainer's identity and let the project's own release pipeline publish version 0.5.144 of the tensorlake npm SDK. The poisoned release carries a variant of the Shai-Hulud worm that runs during installation, sweeps the host for npm, GitHub, cloud, Kubernetes, Vault, SSH, browser and cryptocurrency wallet secrets, exfiltrates them, and republishes itself into other packages the victim owns. It also plants a dead-man's switch: if the stolen GitHub token is revoked, a background monitor wipes the user's home directory.

02 / Analysis

Attack Details

This attack started inside the project's own GitHub repository, not on npm. On October 7, 2026, someone using a maintainer's identity pushed malicious commits directly to the main branch of tensorlakeai/tensorlake without review, and one of them added a preinstall entry so the code would run automatically during installation. On October 8, the project's own release workflow published tensorlake 0.5.144 to npm, which means the poisoned release even carried a valid provenance attestation. Provenance only proves where a package was built, not that the code inside is clean. With more than 100,000 lifetime installs, one npm install was all it took.

The malware runs the moment the package is installed. The preinstall hook calls node lib/setup.mjs, a scrambled loader that downloads the Bun runtime and uses it to launch the real payload, lib/Math_Symbol.js. Bun is a deliberate choice, since security tools watch Node.js far more closely. Researchers found the loader skips build servers, so developer laptops are the target. It then settles in to survive restarts, running as a gh-token-monitor service on Linux, a LaunchAgent on macOS, and a logon task calling monitor.ps1 on Windows, and it drops .claude/settings.json and .vscode/tasks.json into any repository it can reach so the code fires again when someone opens that project in Claude Code or VS Code. The worst part is the hostage token: the monitor checks the stolen GitHub token every sixty seconds, and the moment GitHub rejects it, the malware deletes the user's home directory. Revoking the token, which is the obvious first move, is exactly what sets it off.

The payload then hunts for secrets, and it casts a wide net. It takes npm and GitHub tokens, AWS, Google Cloud and Azure credentials, Docker and Kubernetes settings, Vault tokens, SSH and GPG keys, .env files, messaging app data, and the configuration files of AI tools such as Claude, Cursor, Windsurf and Zed. It also reads browser profiles and the local databases of fourteen cryptocurrency wallet extensions, which points to an operator who wants to cash in quickly.

It then spreads using the credentials it has just stolen, republishing the victim's other npm packages with itself inside, and committing those AI tool files into their repositories under a fake author with the harmless-looking message "chore: update dependencies". It encrypts everything it collects and pushes it into a new public repository the malware creates in the victim's GitHub account, labelled "Shai-Hulud: Here We Go Again", while a background process reports host and user details to iseekaigogo[.]com. That domain is hardcoded, but the malware is not tied to it, since it can also read an attacker-controlled Ethereum contract to look up a new address to send data to. Because that instruction sits on a public blockchain, the operator can switch infrastructure without publishing a new package, so blocking the known domain alone buys very little time.

03 / Actions

Recommendations

01
Find Every Copy of tensorlake 0.5.144 First
Run npm ls tensorlake across your projects and grep lockfiles, build logs, container images and deployed artefacts for the 0.5.144 string. Include transitive pulls and any machine that cloned or pulled tensorlakeai/tensorlake main after October 7 and ran npm install in the typescript directory. Scope before you touch anything, because the cleanup order matters here.
02
Remove the gh-token-monitor Before Revoking Anything
On every affected host, find and delete the token monitor before a single credential is rotated. On Linux, disable and remove gh-token-monitor.service along with the ~/.config/gh-token-monitor directory and the helper script in ~/.local/bin. On macOS, unload and delete com.user.gh-token-monitor.plist from ~/Library/LaunchAgents. On Windows, delete the ONLOGON scheduled task that runs monitor.ps1. Back up anything irreplaceable first.
03
Rotate Credentials Only After the Monitor Is Gone
Once the switch is disarmed, revoke and replace everything the malware could reach from a known-clean machine: GitHub and npm tokens, AWS, Azure and Google Cloud keys, SSH and GPG keys, Kubernetes and Vault credentials, secrets held in .env files, AI tool API keys, browser-saved passwords and any wallet material. Revoking the GitHub token while the monitor is still alive triggers the home directory wipe no matter where the revocation is performed.
04
Pin tensorlake to 0.5.143
Version 0.5.143 and earlier contain neither the preinstall hook nor the payload files. Pin to it, delete node_modules, clear the npm cache and reinstall from clean sources until a verified good release ships. Treat the six tensorlake-native 0.5.144 binary packages as part of the same tainted release and avoid them even though no payload was found inside them.
05
Turn Off npm Lifecycle Scripts Where You Can
The entire attack hangs on a preinstall hook. Setting ignore-scripts=true in .npmrc, or installing with --ignore-scripts, stops this class of payload before it ever runs. Apply it to CI runners and developer machines wherever your build tolerates it.
06
Block the C2 Domain and Hunt the File Hashes
Block iseekaigogo[.]com at DNS, proxy and endpoint layers, and sweep file systems for the known SHA-256 values of setup.mjs and Math_Symbol.js. Treat this as a floor rather than a fix, since the Ethereum dead drop lets the operator swap domains without shipping a new package.
07
Audit npm and GitHub Accounts for Worm Spread
Look for newly created public repositories carrying the description "Shai-Hulud: Here We Go Again", commits authored by claude@users.noreply.github.com, package versions published under your accounts that nobody on the team recognises, unexpected personal access tokens and new GitHub Actions workflows. The worm republishes through the victim's own identity, so your account activity log is the clearest early warning.
08
Rebuild Hosts You Cannot Prove Are Clean
Any workstation, build runner or server that installed 0.5.144 should be treated as fully compromised, not merely infected. Removing the dependency does not remove a persistent implant. Preserve evidence for investigation, then rebuild from trusted media and restore access to secrets only once the host is verified clean.

04 / Indicators

Indicators of Compromise (IoCs)

Type	Value
SHA256	25a0735d0db7dc40e5d45ce42d9c106067e6a66e184d967cfecfab17c3bcb5ef b50a00900399ba99fb6ce1fc151519cb99d44320ef2a631f2237e1aea0ad6fec
Domain	iseekaigogo[.]com
Email	claude[@]users[.]noreply[.]github[.]com
File Path	lib/setup.mjs lib/Math_Symbol.js
npm Package	tensorlake@0.5.144
Ethereum Address	0xb614155Fd88114d40549b259457Bcf921Df091B9 0x779f83aE56309682beDb04816c19d358c4B21040

05 / Mapping

MITRE ATT&CK TTPs

Resource Development

T1583 Acquire Infrastructure

T1583.001 Domains

Initial Access

T1195 Supply Chain Compromise

T1195.002 Compromise Software Supply Chain

T1078 Valid Accounts

Execution

T1059 Command and Scripting Interpreter

T1059.007 JavaScript

T1059.001 PowerShell

Persistence

T1053 Scheduled Task/Job

T1053.005 Scheduled Task

T1543 Create or Modify System Process

T1543.002 Systemd Service

T1543.001 Launch Agent

T1546 Event Triggered Execution

Defense Evasion

T1027 Obfuscated Files or Information

T1553 Subvert Trust Controls

T1036 Masquerading

Credential Access

T1552 Unsecured Credentials

T1552.001 Credentials In Files

T1552.004 Private Keys

T1552.005 Cloud Instance Metadata API

T1528 Steal Application Access Token

T1555 Credentials from Password Stores

T1555.003 Credentials from Web Browsers

Discovery

T1083 File and Directory Discovery

Collection

T1005 Data from Local System

Command and Control

T1071 Application Layer Protocol

T1071.001 Web Protocols

T1105 Ingress Tool Transfer

Exfiltration

T1567 Exfiltration Over Web Service

T1567.001 Exfiltration to Code Repository

Impact

T1485 Data Destruction

06 / Sources

References & Patch Links

References

What Next?

At Hive Pro, it is our mission to detect the most likely threats to your organization and to help you prevent them from happening.

Book a Demo of HivePro