tensorlake NPM package compromised with Shai Hulud worm

What it is

The tensorlake npm package compromise (v0.5.144, ~100k lifetime installs) by a Shai-Hulud worm variant, published 8 October 2026. Tensorlake also ships packages via PyPI and Cargo, but neither shows signs of compromise as of writing.

How it works

The threat actor made verified commits under a hijacked maintainer identity on 7 October, introducing the malware in commit 41b38f0 via direct file upload, then bumping the version and triggering npm publish roughly 20 hours later. The preinstall script runs node lib/setup.mjs, which drops the Bun runtime and uses it to execute lib/Math_Symbol.js, the obfuscated Shai-Hulud payload. The payload sets a global WORMTAG marker specific to this tensorlake compromise — a sign this is a novel infection rather than reinfection from a prior Shai-Hulud wave. Compared to earlier waves, this variant is more oriented toward quick monetization than supply-chain spread: it targets 14 hardcoded cryptocurrency browser-extension paths, exfiltrating IndexedDB/LevelDB files, and fetches a platform-appropriate HackBrowserData binary from the C2 to pull additional browser-stored credentials.

flowchart TD
    A[npm install triggers preinstall] --> B[setup.mjs drops Bun runtime]
    B --> C[Bun executes Math_Symbol.js payload]
    C --> D[Set WORMTAG marker]
    C --> E[Exfiltrate CI/cloud secrets + browser crypto data]
    C --> F[Query Ethereum contract for fallback C2]
    F -->|resolves to| G[iseekaigogo.com]
    C --> H{GitHub token revoked?}
    H -->|yes| I[Dead-man's switch wipes machine]

Preconditions / Affected

Any system that installed tensorlake 0.5.144 via npm. PyPI and Cargo distributions of tensorlake are not reported as affected.

What to do

• Treat any system that installed tensorlake@0.5.144 as fully compromised; rotate all secrets/credentials it had access to as a critical priority.
• Check for the IOC file hashes: lib/setup.mjs (sha256 25a0735d0db7dc40e5d45ce42d9c106067e6a66e184d967cfecfab17c3bcb5ef) and lib/Math_Symbol.js (sha256 b50a00900399ba99fb6ce1fc151519cb99d44320ef2a631f2237e1aea0ad6fec).
• Block/alert on C2 domain iseekaigogo[.]com.
• Aikido users: filter the central feed on malware issues (surfaces as a 100/100 critical issue) and trigger a manual rescan rather than waiting for the nightly scan.

Caveats

The post states the malware "contains slight variations from the last Shai-Hulud wave," which they infer indicates a novel compromise rather than ongoing reinfection — this is their interpretation, not a confirmed attribution.