Tensorlake npm Package Compromised to Spread Shai-Hulud Worm

What it is

tensorlake@0.5.144, published to npm on 8 October 2026, carries a new Shai-Hulud worm variant, per Aikido's technical report. Tensorlake is a serverless sandbox platform for AI agents, and its npm package has more than 100,000 lifetime installs. Aikido found no sign of compromise in the PyPI and Cargo distributions at the time of analysis.

How it works

An actor made verified commits under a maintainer identity on 7 October. Commit 41b38f0 uploaded the payload to the GitHub repository, which stayed compromised for about 20 hours before the npm release.

Install triggers a preinstall script that runs node lib/setup.mjs. That script is heavily obscured, downloads the Bun runtime, and uses it to launch lib/Math_Symbol.js, the main payload. Running under a freshly downloaded runtime may slip past controls that watch Node.js activity. The code sets a unique global WORMTAG marker, which Aikido takes as evidence of a fresh compromise rather than a reinfection from an earlier wave.

The payload collects secrets from:

• environment variables and local credential files
• AWS keys, Kubernetes configs, Azure data, Docker credentials and GitHub Copilot settings
• CI/CD systems, SSH folders, Vault tokens and GitHub-related data
• browser profiles, including extension databases for wallets such as MetaMask, Phantom, Coinbase Wallet, Rabby, Exodus and OKX

Exfiltration goes to the hardcoded domain iseekaigogo[.]com. The malware can also query an actor-controlled Ethereum smart contract through public RPC services to get a replacement address. At the time of the report the contract pointed to the same domain. This lets the actor move infrastructure without publishing a new package version.

The payload also has a dead-man's switch: Aikido says it can wipe the infected machine when an embedded GitHub token is revoked.

Preconditions / Affected

Any workstation, build runner or server that installed tensorlake@0.5.144. The page says to treat these as fully compromised. The page gives no safe-version information.

What to do

The order matters because of the wipe trigger. Isolate affected devices and preserve evidence first, then rotate credentials, since revoking the embedded GitHub token may trigger the wipe.

• Rotate npm, GitHub, cloud, CI/CD, SSH, Vault, browser and wallet credentials from a clean system.
• Review package publishing logs and repository changes for unauthorized releases.
• Remove the dependency, restore a known-good lockfile, and rebuild environments where practical.
• Inspect logs for unexpected Bun downloads or execution.
• Scan repositories for lib/setup.mjs and lib/Math_Symbol.js.
• Block iseekaigogo[.]com at DNS, proxy and endpoint layers. Blocking the domain alone will not stop the contract-based fallback.
• Use pinned versions, short-lived credentials, least-privilege publishing tokens and release approvals.

Caveats

The page's IoC list was empty in the fetched text, so no file hashes or other indicators are available beyond the domain, file names and commit. The wipe behaviour is attributed to Aikido and is not independently confirmed in the page.