Skip to content
Today
Sections

Build Independently confirmed2 publishers 2 min read Published Updated

Tensorlake npm worm ships a service that runs rm -rf ~/ when its stolen GitHub token is revoked

Tensorlake's npm SDK 0.5.144 carried a Shai-Hulud worm on October 8 that steals GitHub and npm tokens, cloud keys and AI coding-tool configs. A dev.to write-up of StepSecurity's teardown says revoking the stolen GitHub token triggers an rm -rf ~/, so the service must go first.

The Engineer · Build desk

Send a correction

Illustration accompanying Tensorlake npm worm ships a service that runs rm -rf ~/ when its stolen GitHub token is revoked
Generated illustration
Worm service rechecks the stolen GitHub token How often the worm's service tests the stolen GitHub token, when Socket flagged the release, and the obfuscated file's size, per dev.to.

Three figures from the dev.to write-up: the worm's background service checks the stolen GitHub token every 60 seconds, which is unconfirmed; Socket flagged the release about 11 minutes after publication; the preinstall hook uses Bun to run an obfuscated 856 KB JavaScript file.

Worm service rechecks the stolen GitHub token
FigureValueNoteClaim
How often the service checks the stolen GitHub token60 secondsunconfirmed22
Publish to Socket flag11 minutes, about14
Obfuscated file Bun runs856 KB6

What happened

  • The first malicious commit reached the main branch on October 7 at 01:20 UTC under a maintainer's name, and seven more followed over the next few hours without a pull request.
  • The repo's own release workflow published 0.5.144 on October 8 at 01:12 UTC, and npm displayed a valid provenance attestation for it.
  • Socket flagged the release about 11 minutes after it was published.
  • The bad version has been removed from npm, and Endor Labs says 0.5.143 is clean and is the version to pin to.

Why it matters

  • What doesn't add up contradiction Endor Labs' five-step remediation puts rotation third and never mentions a service, while the dev.to write-up says a revoked GitHub token is the wipe trigger.
  • Who's exposed exposure A stolen .claude folder or MCP config hands over API keys, the list of servers an agent can call and, in many setups, credentials for those servers.
  • What it sets up precedent The Shai-Hulud family republishes itself into other packages its victim controls, so one unrotated npm token on an infected machine is a candidate for the next malicious release.
  • What it limits constraint A provenance attestation cannot screen this release: it is valid because the project's real workflow built it, and Endor notes it shows where a build came from, not that the source was clean.

The loader is where exposure starts. Endor Labs says the attacker added a preinstall hook that runs node lib/setup.mjs, and because npm runs preinstall before anything else, the code executes on npm install ahead of any application code [5]. The dev.to write-up says the hook skips CI environments, then downloads the Bun runtime and uses it to run an obfuscated 856 KB JavaScript file [6]. Endor describes the loader as checking CI variables before it fetches a second stage [7]. It also tells teams to assume credential theft on any host that installed 0.5.144, and it singles out CI [17].

The wipe is a separate component. According to the dev.to write-up, citing StepSecurity's teardown, the worm installs a small background service that checks every 60 seconds whether the stolen GitHub token still works, and that service runs rm -rf ~/ if the token was revoked [22]. The malware source contains the string IfYouRevokeThisTokenItWillWipeTheComputerOfTheOwner [23]. As documentation goes, it is candid.

A 60-second poll means the next check after a revocation comes within a minute [24]. Endor's indicator list shows a daemon that POSTs the victim's host, user and OS to iseekaigogo[.]com [8]. Endor calls that domain disposable and rotated on-chain, and names the Ethereum resolver wallet as the durable indicator [9].

Only one of our two sources describes the wipe. The dev.to author wrote "I did not investigate this incident myself" and credits StepSecurity, Socket, Tensorlake's advisory and The Register [18].

In our view the dev.to ordering is the safe one until StepSecurity's teardown is checked directly. Removing the service first costs one extra step. Revoking first, if the write-up is right, costs the home directory [22]. For a machine that installed 0.5.144, the sequence is:

1. Pin tensorlake to 0.5.143, which Endor says is clean, and clear 0.5.144 from lockfiles and package caches [15][21]. Treat the six tensorlake-native-*@0.5.144 packages as part of the affected release. Endor found no install script and no payload in them but says to avoid them [16]. 2. Find and remove the background service, taking its name and location from the StepSecurity and Socket teardowns the write-up cites [18]. 3. Rotate npm tokens, GitHub tokens, SSH keys, cloud keys and any other secrets that were on the host [17]. 4. Review GitHub and npm for unexpected repositories, new tokens and publishes [19]. The write-up says stolen data goes to a public repository in the victim's own account, described as "Shai-Hulud: Here We Go Again" [11].

Endor also suggests installing with scripts disabled where practical, for example npm install --ignore-scripts, since the payload depends on the preinstall hook [20].

What to watch

  • StepSecurity's or Socket's own teardown confirming or contradicting the wipe behavior, and naming the service and where it installs.
  • Whether Endor Labs or Tensorlake's advisory adds service removal ahead of rotation in its remediation steps.
  • Whether the on-chain resolver moves the command-and-control domain off iseekaigogo.com, which Endor says is rotated.

Clarity's read

What the record supports and how the coverage leans. The claims behind it follow.

Reality

Evidence66
Adoption
Not scored
Hype gap+30
Incentives45
Confidence62
Why these scores

Claim ledger

Ranked by verification strength, evidence, and original report placement.

  1. [1]

    On October 8, 2026, the npm package tensorlake published version 0.5.144 carrying a malicious payload from the Shai-Hulud worm family.

    Reported Supported Source: Endor LabsView cited source
  2. [2]

    The worm harvested GitHub and npm tokens, cloud keys, SSH keys, and the config files of AI coding tools.

    Reported Supported Source: dev.to write-up citing StepSecurity, Socket, Tensorlake and The RegisterView cited source
  3. [3]

    The first malicious commit landed on the main branch of the Tensorlake repo on October 7 at 01:20 UTC under a maintainer's name; seven more commits followed over the next few hours and none went through a pull request.

    Reported Supported Source: StepSecurity timeline as relayed by dev.toView cited source
  4. [4]

    The repo's own release workflow published version 0.5.144 to npm on October 8 at 01:12 UTC, and npm showed a valid provenance attestation for it.

    Reported Supported Source: StepSecurity timeline as relayed by dev.toView cited source
  5. [5]

    The attacker added a preinstall hook to the package manifest that runs node lib/setup.mjs; because npm runs preinstall before anything else, the code executes on npm install before any application code.

    Reported Supported Source: Endor LabsView cited source
  6. [6]

    The preinstall hook skips CI environments and targets developer machines, downloads the Bun runtime, and uses it to execute an obfuscated 856 KB JavaScript file.

    Reported Supported Source: dev.to write-upView cited source
  7. [7]

    The loader checks whether it is running in CI by inspecting variables such as CI, GITHUB_ACTIONS, GITLAB_CI and RUNNER_ENVIRONMENT, and then pulls down and runs a second stage.

    Reported Supported Source: Endor LabsView cited source
  8. [8]

    Endor's indicators list the C2 domain iseekaigogo[.]com, to which a daemon POSTs the victim host, user and OS.

    Reported Supported Source: Endor LabsView cited source
  9. [9]

    The C2 domain is disposable and rotated on-chain; the Ethereum resolver wallet (EtherHiding dead-drop) is the durable indicator.

    Reported Supported Source: Endor LabsView cited source
  10. [10]

    The .claude folder and MCP configuration files contain API keys, the list of servers agents can call, and in many setups credentials for those servers.

    Reported Supported Source: dev.to write-upView cited source
  11. [11]

    Exfiltrated data is encrypted and sent to a public GitHub repository created in the victim's own account, described as "Shai-Hulud: Here We Go Again", or to the domain iseekaigogo.com.

    Reported Supported Source: dev.to write-upView cited source
  12. [12]

    Provenance confirms where a build came from, not that the source was clean.

    Reported Supported Source: Endor LabsView cited source
  13. [13]

    The Shai-Hulud family steals a developer's npm and GitHub credentials, then uses them to republish itself into other packages the victim controls and to create repositories that hold the stolen data.

    Reported Supported Source: Endor LabsView cited source
  14. [14]

    Socket flagged the release about 11 minutes after publication.

    Reported Supported Source: dev.to write-upView cited source
  15. [15]

    The bad version has been removed from npm and the previous version 0.5.143 is clean; Endor says to pin to 0.5.143 until a known good release is published.

    Reported Supported Source: Endor LabsView cited source
  16. [16]

    Six tensorlake-native-*@0.5.144 platform binary packages were published from the same run; they contain only the native binary and no install script, Endor found no payload in them, but they should be treated as part of the affected release and avoided.

    Reported Supported Source: Endor LabsView cited source
  17. [17]

    If 0.5.144 was installed anywhere, especially in CI, assume credential theft: rotate npm tokens, GitHub tokens and SSH keys, cloud keys, and any secrets that were present on that host.

    Reported Supported Source: Endor LabsView cited source
  18. [18]

    The author wrote: "I did not investigate this incident myself"; everything comes from StepSecurity's teardown of the payload, Socket's analysis, Tensorlake's security advisory and coverage in The Register.

    Reported Supported Source: dev.to authorView cited source
  19. [19]

    Remediation includes reviewing recent GitHub and npm activity for unexpected repository creation, new tokens, or unexpected publishes under affected accounts.

    Reported Supported Source: Endor LabsView cited source
  20. [20]

    Endor suggests considering installing with scripts disabled by default, for example npm install --ignore-scripts, where practical, since the payload relies on a preinstall hook.

    Reported Supported Source: Endor LabsView cited source
  21. [21]

    Endor's remediation section has five steps: block and avoid 0.5.144 and pin to 0.5.143; remove lockfile entries and package caches referencing 0.5.144; rotate credentials if it was installed; review GitHub and npm activity; consider installing with --ignore-scripts. Removing a background service is not among them.

    Reported Supported Source: Endor LabsView cited source
  22. [22]

    The worm installed a small background service that checked every 60 seconds whether the stolen GitHub token still worked; if the token was revoked, the service ran rm -rf ~/ on the machine.

    Reported Insufficient Source: dev.to write-up citing StepSecurity's teardownView cited source
  23. [23]

    The malware source contains the literal string IfYouRevokeThisTokenItWillWipeTheComputerOfTheOwner.

    Reported Insufficient Source: dev.to write-upView cited source
  24. [24]

    The worst-case delay between a token revocation and the service's next check is 60 seconds.

    Derived Insufficient

Sources

2 independent publishers whose own reporting we read for this story.

  1. dev.to

    1 article · October 12, 2026

    The Shai-Hulud Worm Now Steals Your AI Agent Credentials: A 20-Minute npm Audit

  2. endorlabs.com

    1 article · October 7, 2026

    Tensorlake npm package compromised by Shai-Hulud in latest software supply chain attack | Blog | Endor Labs

Topics and entities

Topics

Entities