🧰 gh-token-monitor

The items that name it 2

• Tensorlake npm Package Compromised: A Worm With a Hostage Token That Wipes Your Machine If You Revoke It
  writeup2026-10-08

  Malicious background service installed by the malware; polls GitHub API every 60 seconds for up to 24 hours and wipes the home directory (rm -rf ~/ or PowerShell profile delete) if the stolen token is revoked

• Mini Shai-Hulud Worm Compromises TanStack, Mistral AI, Guardrails AI & More Packages
  article

  Malicious service installed by the malware to monitor and re-exfiltrate GitHub tokens