♫Why♥Not♪ (@Python_s_) on X

What it is

A secondary alert on X (not Socket's own post) dated October 8, 2026, reporting that tensorlake@0.5.144 on npm is malicious. Tensorlake is an SDK used in AI-agent infrastructure. The alert attributes the disclosure to Socket Threat Research and classes the malware as ChainDrop / Shai-Hulud.

How it works

• The malicious version runs code at install time through a preinstall hook.
• The payload steals GitHub, npm, AWS, Kubernetes and Vault credentials, sets up persistence, and propagates through compromised publishing accounts.
• The persistence indicator is gh-token-monitor.
• The destructive routine fires when stolen GitHub tokens are revoked.

Preconditions / Affected

• Only version 0.5.144 is named. The alert gives no safe version or fixed release.
• Any development machine or CI/CD runner that installed that version is in scope, because the hook runs at install time.
• The number of affected installations is stated as unknown.

What to do

Check for the version and the indicators first:

• Package: tensorlake@0.5.144
• Files: lib/setup.mjs, lib/Math_Symbol.js
• Persistence: gh-token-monitor

Then follow the alert's order of response:

1. Block the compromised version and investigate dev and CI/CD environments that may have installed it.
2. Isolate affected hosts.
3. Remove the token-monitor persistence before revoking any stolen GitHub tokens, because revocation triggers the destructive routine.
4. Rotate exposed secrets only after containment.
5. Rebuild compromised environments from trusted sources.

Caveats

• The alert gives no removal commands for the persistence. It doesn't say where gh-token-monitor lives or what the destructive routine deletes. The Socket blog link is truncated, so get those details from Socket's original write-up before acting.
• The "very high" confidence rating is the alert author's own, resting on Socket's analysis. I haven't checked it against the primary source.
• Socket's detection about 11 minutes after publication doesn't bound exposure. Anyone who installed during that window, or before the package was pulled, is still affected.