Security researchers flagged on 8 October that version 0.5.144 of the npm SDK for Tensorlake — a cloud platform for running isolated AI agents and untrusted AI-generated code — was published carrying the Shai-Hulud credential-stealing worm, sharing code and techniques with the ChainDrop variant used in August against npm dependencies including keyv and flat-cache. The release, on a package downloaded roughly 12,000 times a week from a repository with more than a thousand stars, was detected by Socket's engine 11 minutes after publication and removed by npm; Tensorlake pulled it and shipped 0.5.145. Analysis by supply-chain firm SafeDep found the release steals crypto wallets, browser passwords, GitHub Actions secrets, cloud credentials and service-account tokens, exfiltrates them and holds a command-and-control channel open — and a token-monitoring feature can trigger deletion of an infected user's home directory under specific conditions when a stolen GitHub token is revoked, so researchers warn it must be disabled before rotating credentials. Socket stresses that the install script runs outside Tensorlake's sandbox, on the developer workstation, application server or build runner that installs it, inheriting that machine's permissions. The OpenSourceMalware archive independently holds a critical record for tensorlake 0.5.144, first seen 8 October.

• Source article