Skip to content

Back to the catalog

Tensorlake npm package compromised by Shai-Hulud in latest software supply chain attack | Blog | Endor Labs
endorlabs.comadvisory

Tensorlake npm package compromised by Shai-Hulud in latest software supply chain attack | Blog | Endor Labs

Endor Labs documents the compromise of tensorlake@0.5.144, the official npm TypeScript SDK for Tensorlake, which shipped a Shai-Hulud worm payload via a poisoned preinstall hook (node lib/setup.mjs) after the project's main branch was altered and pushed through a legitimate, provenance-signed GitHub Actions release pipeline. The malware harvests npm, GitHub, SSH, cloud (AWS/GCP/Azure), Kubernetes/Docker and Vault credentials, uses an EtherHiding Ethereum wallet as a durable dead-drop to fetch its rotating C2 domain, and republishes itself into other packages the victim controls. The writeup includes affected package versions, file hashes, C2 indicators, and concrete remediation guidance (pin to 0.5.143, rotate credentials, disable install scripts).

TL;DR Shai-Hulud worm infected tensorlake@0.5.144 via a compromised-maintainer commit pushed through a legit, provenance-signed GitHub Actions pipeline, stealing npm/GitHub/cloud credentials and using an EtherHiding wallet as its C2 dead-drop.
Open original ↗
Document

What it is

Shai-Hulud worm payload shipped in tensorlake@0.5.144 (official Tensorlake TypeScript SDK), published 2026-10-08 01:12:07 UTC via a preinstall hook (node lib/setup.mjs). Root cause: the project's main branch was altered first (first malicious commit e90c47bbb2, 2026-10-07 01:20 UTC), then a legitimate, provenance-signed GitHub Actions run (runs/37706134202) published the poisoned build — provenance confirms build origin, not source cleanliness.

How it works

lib/setup.mjs is a small obfuscated loader; lib/Math_Symbol.js (~856 KB) is the main obfuscated payload, internally tagged globalThis.WORMTAG='tensrlake'. On npm install, the preinstall hook runs before any application code. The loader checks for CI environment variables (CI, GITHUB_ACTIONS, GITLAB_CI, RUNNER_ENVIRONMENT) to detect pipeline execution, then fetches a second stage. It calls the GitHub API and npm registry to harvest tokens, republish itself into other packages the victim controls, and create repos to hold exfiltrated data. C2 domain resolution uses EtherHiding: an Ethereum wallet address (0xb614155Fd88114d40549b259457Bcf921Df091B9) acts as an on-chain dead-drop the malware reads to fetch the current (rotating) C2 domain — currently iseekaigogo[.]com, which receives POSTed victim host/user/os data.

Preconditions / Affected

  • tensorlake@0.5.144 (npm, now removed from registry) — contains the hook and payload.
  • Six tensorlake-native-*@0.5.144 platform binary packages published in the same run — no install script, no payload found, but should still be avoided as part of the tainted release.
  • tensorlake@0.5.143 and earlier are clean — no hook, no payload files.
  • On cloud/CI hosts, the payload also probes internal metadata/credential endpoints: 169.254.169.254 (AWS IMDS), 169.254.170.2 (ECS/container credentials), 127.0.0.1:8200 (local Vault).

What to do

  • Pin to 0.5.143 until a clean release exists; block 0.5.144.
  • Remove lockfile entries/package caches referencing 0.5.144, then reinstall clean.
  • If 0.5.144 was installed anywhere (especially CI), treat all credentials on that host as exposed: rotate npm tokens, GitHub tokens, SSH keys, cloud keys (AWS/GCP/Azure), Kubernetes/Docker and Vault secrets.
  • Audit recent GitHub/npm activity on affected accounts for unexpected repo creation, new tokens, or unexpected publishes.
  • Where practical, install with scripts disabled:
npm install --ignore-scripts
  • SHA256 IOCs: lib/setup.mjs = 25a0735d0db7dc40e5d45ce42d9c106067e6a66e184d967cfecfab17c3bcb5ef; lib/Math_Symbol.js = b50a00900399ba99fb6ce1fc151519cb99d44320ef2a631f2237e1aea0ad6fec.

Caveats

The page notes the six native-binary packages were checked and no payload was found in them, but recommends avoiding them anyway since they came from the same compromised release run.

Technologies named here

Techniques named here

  • Malicious npm preinstall hook
  • Obfuscated loader and payload
  • CI environment detection
  • Credential/secret harvesting
  • Cloud instance metadata probing
  • Worm propagation via stolen credentials
  • EtherHiding
  • Exfiltration via C2 domain

Threat actors named here

Related in Supply Chain