Tensorlake npm Package Compromised: A Worm With a Hostage Token That Wipes Your Machine If You Revoke It

What it is

tensorlake@0.5.144, published to npm from the tensorlakeai/tensorlake GitHub repo after eight malicious commits (e90c47b through 6386121) landed directly on main under a maintainer's identity between 01:20 UTC Oct 7 and the npm release at 01:12 UTC Oct 8. StepSecurity's AI Package Analyst flagged it; the issue is tracked at tensorlakeai/tensorlake#1014. The payload lives under typescript/lib/.

How it works

The preinstall hook runs setup.mjs, which skips execution on CI (so it only fires on developer machines), downloads the Bun runtime, and uses it to execute an 856 KB obfuscated file (Math_Symbol.js). Stolen data is encrypted and exfiltrated either to a GitHub repo the malware creates in the victim's account (description "Shai-Hulud: Here We Go Again") or to the domain iseekaigogo.com. Propagation commits use a spoofed author claude@users.noreply.github.com and the message "chore: update dependencies."

Preconditions / Affected

• npm: tensorlake@0.5.144 (still downloadable from npm at time of writing).
• GitHub: tensorlakeai/tensorlake main, commits e90c47b–6386121.
• Only developer machines are at risk — the preinstall hook explicitly skips CI environments.

What to do

Order matters: removing the token monitor must happen before revoking the GitHub token, or the wipe triggers.

flowchart TD
    A[Detect: npm ls tensorlake / check lockfiles for 0.5.144] --> B[Pin to tensorlake@0.5.143, delete node_modules, npm cache clean --force]
    B --> C{~/.config/gh-token-monitor/ exists?}
    C -->|Yes| D[Disable/remove monitor service - Linux/macOS/Windows steps]
    C -->|No| E[Rotate GitHub token]
    D --> E
    E --> F[Rotate npm, cloud, SSH, K8s/Vault, .env, AI tool keys, browser passwords]
    F --> G[Check for spread: new 'Shai-Hulud' repos, claude@users.noreply.github.com commits, stray .claude/.vscode files]

Removal commands given by the page:

Linux:

systemctl --user disable --now gh-token-monitor.service
rm -rf ~/.config/gh-token-monitor ~/.local/bin/gh-token-monitor.sh ~/.config/systemd/user/gh-token-monitor.service

macOS:

launchctl bootout gui/$(id -u) ~/Library/LaunchAgents/com.user.gh-token-monitor.plist
rm -rf ~/.config/gh-token-monitor ~/.local/bin/gh-token-monitor.sh ~/Library/LaunchAgents/com.user.gh-token-monitor.plist

Windows: check Task Scheduler for a logon task running a monitor.ps1 script and delete it.

Also set ignore-scripts=true in .npmrc to block install hooks like this one going forward. If the package only ran in CI, the hook self-skips, but still rotate whatever secrets that CI job could see. If unsure the machine is clean, wipe and reinstall.

IOCs: SHA-256 of lib/setup.mjs = 25a0735d0db7dc40e5d45ce42d9c106067e6a66e184d967cfecfab17c3bcb5ef; SHA-256 of lib/Math_Symbol.js = b50a00900399ba99fb6ce1fc151519cb99d44320ef2a631f2237e1aea0ad6fec; domain iseekaigogo.com; filesystem artifacts ~/.config/gh-token-monitor/ and ~/.local/bin/gh-token-monitor.sh.

Caveats

The monitor only runs for up to 24 hours (checking the stolen token every 60 seconds), so a stale infection beyond that window may no longer trigger the wipe on revocation — the page does not state whether the service self-removes after that period.