TensorLake npm SDK Used to Spread Credential-Stealing Malware

Summary

A compromised release of the Tensorlake npm SDK, version 0.5.144, was discovered in a supply chain attack associated with ChainDrop / Shai-Hulud. The malicious package abuses a preinstall hook to launch an obfuscated loader that installs a credential-stealing worm. The malware targets sensitive tokens, cloud credentials, and AI development tool configurations while also incorporating a destructive dead-man switch.

Investigation

Socket Research uncovered the compromise after detecting a malicious preinstall hook within the package manifest. Analysis showed that the loader uses Bun to execute a payload capable of harvesting credentials and propagating through npm. Researchers also identified a PowerShell-based persistence mechanism and an Ethereum-based technique for resolving command-and-control infrastructure.

Mitigation

Users should immediately block and remove Tensorlake version 0.5.144 and audit all environments where its installation script may have executed. The gh-token-monitor persistence mechanism should be removed before revoking compromised GitHub tokens to avoid triggering the dead-man switch and potential directory deletion. Organizations should also rotate exposed secrets, including AWS, GitHub, and Kubernetes credentials.

Response

Any host that executed the malicious code should be treated as fully compromised and isolated for investigation. Remove identified persistence files and scheduled tasks across Linux, macOS, and Windows systems. After eliminating persistence, perform a complete credential rotation and rebuild affected environments from trusted, known-good sources.

Simulation Execution

• Attack Narrative & Commands: The adversary has successfully gained initial access and is looking to establish persistence. Following the Shai-Hulud methodology, the attacker drops a malicious binary named gh-token-monitor into a hidden directory (e.g., /tmp/.hidden/). The goal is to run this process to monitor GitHub tokens, which would allow for further credential harvesting and lateral movement. The attacker executes the binary to establish its presence, which should trigger the detection rule based on the filename.

• Regression Test Script:

  #!/bin/bash
  # Create a hidden directory to mimic adversary behavior
  mkdir -p /tmp/.hidden/
  
  # Create a dummy binary named gh-token-monitor
  echo -e '#!/bin/bashnecho "Monitoring GitHub tokens..."nsleep 3600' > /tmp/.hidden/gh-token-monitor
  
  # Make the dummy binary executable
  chmod +x /tmp/.hidden/gh-token-monitor
  
  # Execute the binary to trigger the detection rule
  /tmp/.hidden/gh-token-monitor &
  
  # Capture the PID to allow for cleanup
  ATTACK_PID=$!
  echo "Simulation running with PID: $ATTACK_PID"
  sleep 5
  kill $ATTACK_PID

• Cleanup Commands:

  # Remove the malicious directory and dummy binary
  rm -rf /tmp/.hidden/