Shai-Hulud worm variant compromised the Tensorlake npm SDK for AI-agent sandboxes
2026-tensorlake-npm-shaihulud-compromise · 2026-10-08
A malicious release of the Tensorlake npm SDK (tensorlake@0.5.144, ~12K weekly downloads) carried a Shai-Hulud/ChainDrop worm payload that ran on install, harvested developer and cloud credentials, and republished itself under the victim's npm identity. Tensorlake provides isolated sandboxes for running untrusted LLM-generated code, so the compromised SDK ran on the developer and agent-infrastructure machines that integrate it.
System
- Framework
- npm ecosystem; Tensorlake SDK (AI-agent sandbox infrastructure)
- Tools
- npm, github, aws, hashicorp-vault, kubernetes
- Vendor
- Tensorlake
- Autonomy
- supervised-autonomous
Classification
- Primary class
- supply-chain-compromise
- Chain
- supply-chain-compromise/dependency → data-exfiltration/via-tool → unsafe-action/data-deletion
- Attack vector
- supply-chain
- Causation
- entity: human · intentionality: intentional · timing: post-deployment
Trigger
Installing tensorlake@0.5.144 ran a preinstall lifecycle hook ("node lib/setup.mjs") that executed an obfuscated payload before the SDK was ever imported. The payload matched the ChainDrop/Shai-Hulud pattern previously seen in the keyv and cacheable compromises: it harvested secrets, established persistence, and republished malware under the victim's npm identity.
Root cause
npm executes package-provided install lifecycle scripts automatically, so a single poisoned release of a trusted dependency runs attacker code on every consumer's machine. Credentials stolen from one victim let the worm build Sigstore provenance and republish under that victim's publishing identity, propagating without a human in the loop.
Contributing factors
- npm preinstall lifecycle scripts run untrusted code by default during install.
- Stolen npm and GitHub credentials enabled trusted-name republishing and self-propagation.
- The SDK is embedded in AI-agent sandbox infrastructure, broadening where the install script executed.
- Secrets were reachable from developer and CI hosts (.npmrc, IMDS/ECS, Vault, kubeconfig).
Detection
Socket's scanning flagged the malicious tensorlake@0.5.144 roughly 11 minutes after it was published to npm, attributing it to the Shai-Hulud/ChainDrop worm lineage; corroborated by Endor Labs and other security vendors.
Recovery
The malicious version was removed from npm; guidance was to pin to the prior clean release (0.5.143), audit any host where the install script ran, and rotate exposed npm, GitHub, SSH, cloud, Vault, and Kubernetes secrets.
Prevention
Install dependencies with lifecycle scripts disabled by default and require explicit approval for install-time execution; pin and verify dependency versions; scope and rotate CI and cloud credentials; monitor npm for credential-driven republish patterns and anomalous provenance.
Blast radius
- Data
- The payload targeted npm tokens (.npmrc, npm token API, OIDC exchange), GitHub tokens, AWS credentials (IMDS, ECS, Secrets Manager, SSM), HashiCorp Vault secrets, Kubernetes service-account tokens and kubeconfig files, and SSH keys. A dead-man switch monitored stolen GitHub tokens and triggered data wiping on token revocation. credentials
- User harm
- Credential and secret exposure on any developer or CI host that installed tensorlake@0.5.144 during the exposure window; the package had roughly 12K weekly downloads. economic
- Scope
- tensorlake npm SDK (~12K weekly downloads); hosts that ran the install script
- Reversibility
- irreversible
References
- OWASP LLM
- LLM02 LLM03 LLM06
- MITRE ATLAS
- AML.T0024
- Tags
- supply-chain npm-worm shai-hulud chaindrop self-propagating credential-theft ai-agent-infra
Sources
Cite this incident
Permalink: https://swarmproof.github.io/agent-postmortems/2026-tensorlake-npm-shaihulud-compromise/
@misc{2026-tensorlake-npm-shaihulud-compromise,
title = {Shai-Hulud worm variant compromised the Tensorlake npm SDK for AI-agent sandboxes},
year = {2026},
howpublished = {agent-postmortems},
url = {https://swarmproof.github.io/agent-postmortems/2026-tensorlake-npm-shaihulud-compromise/}
}