Shai-Hulud Variant Compromises the Tensorlake npm SDK for AI Agent Sandboxes and Wipes Home Directories if Its Token Is Revoked

`tensorlake` npm package 0.5.144 (about 12,000 weekly downloads), the SDK for Tensorlake's AI agent sandbox platform

Malicious commits were pushed to the tensorlakeai/tensorlake main branch under a maintainer identity without a pull request, and the release workflow published 0.5.144 at 01:12 UTC on October 8, 2026 with valid npm provenance. Socket flagged it 11 minutes later. A preinstall hook skips CI and runs on developer machines, stealing GitHub and npm tokens, cloud, Kubernetes, and Vault secrets, SSH keys, browser logins, crypto wallets, and Claude, Cursor, and Windsurf configurations. It republishes the victim's npm packages, commits `.claude/settings.json` and `.vscode/tasks.json` files that re-run the payload when a repository is opened in Claude Code or VS Code, and resolves C2 through an Ethereum contract. A token monitor checks the stolen GitHub token every 60 seconds and deletes the home directory if it is revoked. Tensorlake released a clean 0.5.145. Researchers tie it to the ChainDrop Shai-Hulud variant

Push access to the main branch fed an automated release pipeline with no review gate, so provenance attested to a malicious build, and install-time hooks ran with the developer's full credentials