Skip to content
Today
Sign in

BuildIndependently confirmed2 publishers2 min readPublished

Tensorlake npm worm ships a service that runs rm -rf ~/ when its stolen GitHub token is revoked

Tensorlake's npm SDK 0.5.144 carried a Shai-Hulud worm on October 8 that steals GitHub and npm tokens, cloud keys and AI coding-tool configs. A dev.to write-up of StepSecurity's teardown says revoking the stolen GitHub token triggers an rm -rf ~/, so the service must go first.

The Engineer · Build desk

How we use AISend a correction

Worm service rechecks the stolen GitHub token How often the worm's service tests the stolen GitHub token, when Socket flagged the release, and the obfuscated file's size, per dev.to.

Three figures from the dev.to write-up: the worm's background service checks the stolen GitHub token every 60 seconds; Socket flagged the release about 11 minutes after publication; the preinstall hook uses Bun to run an obfuscated 856 KB JavaScript file.

Worm service rechecks the stolen GitHub token
FigureValueNoteClaim
How often the service checks the stolen GitHub token60 seconds22
Publish to Socket flag11 minutes, about14
Obfuscated file Bun runs856 KB6

What happened

  • The first malicious commit reached the main branch on October 7 at 01:20 UTC under a maintainer's name, and seven more followed over the next few hours without a pull request.
  • The repo's own release workflow published 0.5.144 on October 8 at 01:12 UTC, and npm displayed a valid provenance attestation for it.
  • Socket flagged the release about 11 minutes after it was published.
  • The bad version has been removed from npm, and Endor Labs says 0.5.143 is clean and is the version to pin to.

Why it matters

  • contradiction Endor Labs' five-step remediation puts rotation third and never mentions a service, while the dev.to write-up says a revoked GitHub token is the wipe trigger.
  • exposure A stolen .claude folder or MCP config hands over API keys, the list of servers an agent can call and, in many setups, credentials for those servers.
  • precedent The Shai-Hulud family republishes itself into other packages its victim controls, so one unrotated npm token on an infected machine is a candidate for the next malicious release.
  • constraint A provenance attestation cannot screen this release: it is valid because the project's real workflow built it, and Endor notes it shows where a build came from, not that the source was clean.

The loader is where exposure starts. Endor Labs says the attacker added a preinstall hook that runs node lib/setup.mjs, and because npm runs preinstall before anything else, the code executes on npm install ahead of any application code [5]. The dev.to write-up says the hook skips CI environments, then downloads the Bun runtime and uses it to run an obfuscated 856 KB JavaScript file [6]. Endor describes the loader as checking CI variables before it fetches a second stage [7]. It also tells teams to assume credential theft on any host that installed 0.5.144, and it singles out CI [17].

The wipe is a separate component. According to the dev.to write-up, citing StepSecurity's teardown, the worm installs a small background service that checks every 60 seconds whether the stolen GitHub token still works, and that service runs rm -rf ~/ if the token was revoked [22]. The malware source contains the string IfYouRevokeThisTokenItWillWipeTheComputerOfTheOwner [23]. As documentation goes, it is candid.

A 60-second poll means the next check after a revocation comes within a minute [24]. Endor's indicator list shows a daemon that POSTs the victim's host, user and OS to iseekaigogo[.]com [8]. Endor calls that domain disposable and rotated on-chain, and names the Ethereum resolver wallet as the durable indicator [9].

Only one of our two sources describes the wipe. The dev.to author wrote "I did not investigate this incident myself" and credits StepSecurity, Socket, Tensorlake's advisory and The Register [18].

In our view the dev.to ordering is the safe one until StepSecurity's teardown is checked directly. Removing the service first costs one extra step. Revoking first, if the write-up is right, costs the home directory [22]. For a machine that installed 0.5.144, the sequence is:

1. Pin tensorlake to 0.5.143, which Endor says is clean, and clear 0.5.144 from lockfiles and package caches [15][21]. Treat the six tensorlake-native-*@0.5.144 packages as part of the affected release. Endor found no install script and no payload in them but says to avoid them [16]. 2. Find and remove the background service, taking its name and location from the StepSecurity and Socket teardowns the write-up cites [18]. 3. Rotate npm tokens, GitHub tokens, SSH keys, cloud keys and any other secrets that were on the host [17]. 4. Review GitHub and npm for unexpected repositories, new tokens and publishes [19]. The write-up says stolen data goes to a public repository in the victim's own account, described as "Shai-Hulud: Here We Go Again" [11].

Endor also suggests installing with scripts disabled where practical, for example npm install --ignore-scripts, since the payload depends on the preinstall hook [20].

What to watch

  • StepSecurity's or Socket's own teardown confirming or contradicting the wipe behavior, and naming the service and where it installs.
  • Whether Endor Labs or Tensorlake's advisory adds service removal ahead of rotation in its remediation steps.
  • Whether the on-chain resolver moves the command-and-control domain off iseekaigogo.com, which Endor says is rotated.

Clarity's read

What the record supports and how the coverage leans. The claims behind it follow.

Reality

Evidence66
Adoption
Insufficient
Hype gap+30
Incentives45
Confidence62
Why these scores

Claim ledger

Ranked by verification strength, evidence, and original report placement.

  1. [1]

    On October 8, 2026, the npm package tensorlake published version 0.5.144 carrying a malicious payload from the Shai-Hulud worm family.

    ReportedSupportedSource: Endor Labs2 sources— create a free account to open themView cited source
  2. [2]

    The worm harvested GitHub and npm tokens, cloud keys, SSH keys, and the config files of AI coding tools.

    ReportedSupportedSource: dev.to write-up citing StepSecurity, Socket, Tensorlake and The Register2 sources— create a free account to open themView cited source
  3. [3]

    The first malicious commit landed on the main branch of the Tensorlake repo on October 7 at 01:20 UTC under a maintainer's name; seven more commits followed over the next few hours and none went through a pull request.

    ReportedSupportedSource: StepSecurity timeline as relayed by dev.to2 sources— create a free account to open themView cited source

Sources

2 independent publishers whose own reporting we read for this story.

  1. dev.to

    1 article · October 12, 2026

    The Shai-Hulud Worm Now Steals Your AI Agent Credentials: A 20-Minute npm Audit

  2. endorlabs.com

    1 article · October 7, 2026

    Tensorlake npm package compromised by Shai-Hulud in latest software supply chain attack | Blog | Endor Labs

Share your take

Let Clarity write the post for you.

Signed-in readers get a short post drafted on this story in the register they choose — narrative, analytical, or a direct position — editable to the last word before it goes anywhere. The share buttons at the top of this story work without an account.

Create a free account to composeSign in

Topics and entities

Follow any of these and your For You feed starts watching them — no settings page required.

Topics

Entities

Loading related stories