David Gutierrez | Eng (@david_x_ai) on X

What it is

A thread by David Gutierrez (@david_x_ai) on two npm compromises in October 2026, @subql/common 5.8.3 (5 October) and tensorlake 0.5.144 (8 October). Its argument is that npm provenance shows where a package was built, not who wrote the code, so the attack surface has moved from the registry to the repository and its CI.

How it works

In @subql/common, the attacker gained push access to the repo and edited the publish workflow. The release then went out through GitHub Actions OIDC Trusted Publishing and looked legitimate.

In tensorlake, a compromised maintainer account pushed code to the repo. The project's own release workflow published it with valid npm provenance. The version was live for about 1 hour 40 minutes.

Both payloads ran on install and targeted cloud, GitHub, Kubernetes, Vault, SSH and .env credentials. The tensorlake payload also took AI tool and MCP configuration.

What to do

The thread's control point is write access, not the provenance badge. It names two things to restrict: who can push to main and who can edit .github/workflows. It says that if an agent or bot can touch either, that access works as a release key, so scope bot and agent permissions accordingly.

For incident runbooks, the tensorlake payload installed a gh-token-monitor service that deletes the home directory if the stolen GitHub token is revoked. The advisory the thread cites says to remove that service before rotating the token. The thread gives no removal commands or file paths.

Caveats

The thread names no branch protection settings, detection queries or indicators of compromise, and it links no advisory text beyond the ordering warning.