Shai-Hulud Worm Infiltrates Tensorlake SDK in Major AI Infrastructure Supply Chain Attack

Shai-Hulud Worm Targets AI Infrastructure

The credential-stealing Shai-Hulud worm has infiltrated Tensorlake's npm package, marking a significant escalation in supply chain attacks targeting AI infrastructure1

1

. Security researchers detected the infection in version 0.5.144 of Tensorlake's SDK on Thursday, with the malicious package having accumulated approximately 12,000 downloads per week1

1

. The Tensorlake GitHub repository has garnered more than a thousand stars, indicating widespread adoption among developers building AI agent platforms and making this npm package compromise particularly concerning for the AI development community.

ChainDrop Variant Delivers Obfuscated Malware

Analysis reveals this attack shares code and techniques with the Shai-Hulud variant dubbed ChainDrop, previously used in August 2026 to compromise npm dependencies including keyv and flat-cache1

1

. The malicious version 0.5.144 contains obfuscated malware delivered through a preinstall hook that launches a JavaScript file, which then executes the main credential-hijacking malware using the Bun runtime2

2

. Socket's security engine flagged the infected version just 11 minutes after publication to npm, demonstrating the rapid detection capabilities now essential for protecting AI development tools1

1

.

Extensive Credential Theft Capabilities

According to SafeDep, this credential-stealing worm is engineered to harvest an extensive range of sensitive data including crypto wallets, browser passwords, GitHub Actions secrets, cloud credentials, and service-account tokens1

1

. The stealer malware specifically targets npm tokens, GitHub tokens, Amazon Web Services credentials and secrets, HashiCorp Vault data, Kubernetes credentials, SSH keys, .env files, cryptocurrency wallets, messaging app data, and configuration files associated with Anthropic Claude, Cursor, Kiro, Windsurf, and Zed2

2

. It drops the HackBrowserData binary, exfiltrates collected data, establishes persistence on the host, and facilitates execution of remotely-supplied code while maintaining an open line to its command-and-control infrastructure2

2

.

Self-Propagation and Destructive Capabilities

The Shai-Hulud worm demonstrates sophisticated self-propagation mechanisms by enumerating packages associated with the victim's publishing identity, building Sigstore provenance, and republishing compromised versions2

2

. Strings referencing a fake Copilot/Dependabot workflow suggest it also plants GitHub Actions workflows to expand its reach. The malware uses an Ethereum contract to resolve its command-and-control endpoint at iseekaigogo[.]com, with GitHub acting as a fallback mechanism to stage encrypted stolen data in a public repository described as "Shai-Hulud: Here We Go Again"2

2

. StepSecurity researcher Ashish Kurmi noted that the malware writes .claude/settings.json and .vscode/tasks.json files into accessible repositories, ensuring it runs again when someone opens the project in Claude Code or VS Code2

2

.

Hostage Token Monitor Raises Stakes

This supply chain attack includes a particularly dangerous "hostage token" component that monitors stolen GitHub tokens through repeated polling of api.github.com/user to verify token validity2

2

. If the victim revokes the token, the monitor executes an attacker-supplied handler through PowerShell's Invoke-Expression cmdlet, likely triggering a destructive routine that can delete the infected user's home directory under specific conditions1

1

. Socket recommends disabling the malicious token monitor before revoking affected credentials and rebuilding compromised systems from a trusted source before restoring access to secrets1

1

.

Timeline and Repository Compromise

According to StepSecurity, the malicious files were pushed to the main branch of tensorlakeai/tensorlake under a maintainer's name, with the first rogue commit occurring on October 7, 2026, at 01:20 a.m. UTC2

2

. A day later, the repository's release workflow published the malicious version 0.5.144 to npm2

2

. Both npm and Tensorlake have since removed the infected version, with Tensorlake updating to version 0.5.1451

1

. Users who installed malicious version 0.5.144 should remove it immediately and rotate all credentials that may have been exposed during the installation process.