tensorlake 0.5.144 on npm shipped the Shai-Hulud credential-stealing worm
The version is already pulled from npm but any CI runner or developer laptop that installed it in the publish window is fully compromised and its tokens are being used to propagate the worm into other packages, so credential rotation cannot wait.
The tensorlake TypeScript SDK was compromised and version 0.5.144 was published to npm carrying obfuscated Shai-Hulud/ChainDrop malware that harvests credentials, exfiltrates secrets, establishes persistence and executes remotely supplied code. The malicious release was built from the project's own main branch and shipped through the legitimate GitHub Actions pipeline with a valid npm provenance attestation, so provenance checks did not flag it. The worm steals GitHub, npm and AWS credentials and can republish infected packages from the victim's own tokens.
Affected: tensorlake 0.5.144 (npm)
How to Test
Grep package-lock.json, yarn.lock and pnpm-lock.yaml across all repos for "tensorlake" at 0.5.144 and run `npm ls tensorlake` in build images; check npm/pnpm caches and CI job logs for an install of 0.5.144; on suspect hosts look for the preinstall hook launching package/lib/setup.mjs and the obfuscated package/lib/Math_Symbo* loader; then review GitHub audit logs for unexpected repository creations, workflow changes and new npm publishes made with your tokens, and check AWS CloudTrail for use of developer keys from unfamiliar sources.
How to Mitigate
Remove the package and rebuild — do not trust cleanup of the host — reimage any machine or runner that installed 0.5.144, pin tensorlake to 0.5.143 or later clean release, and rotate GitHub PATs and OAuth grants, npm automation tokens, AWS keys and any .env/CI secrets from a known-clean system — StepSecurity warns that revoking the stolen GitHub token while the worm is still running on the host makes it wipe the user's home directory, so deal with the machine before the token.