Shai-Hulud in tensorlake@0.5.144: Targeting 14 Crypto Wallets

---

Version 0.5.144 of the official Tensorlake TypeScript SDK (tensorlake) was backdoored with a Shai-Hulud worm designed to harvest credentials and propagate to other packages.
Tensorlake provides infrastructure to execute AI-generated code inside sandboxed environments, but the worm runs during installation on the developer’s workstation before any sandbox is initialized. Socket’s October 8 analysis highlights this distinction.
Exfiltration targets include browser credentials and stored data from 14 cryptocurrency wallet extensions, which Aikido identified as an evolution from earlier Shai-Hulud campaigns.

Modified Source Published with Legitimate Sigstore Provenance

According to Tensorlake’s official pull request #1016, malicious code was committed directly to main through the GitHub web interface using an account with administrative privileges.
An npm publishing workflow was then manually triggered, distributing the poisoned release with legitimate Sigstore provenance.

The incident timeline is documented across StepSecurity’s analysis and Socket’s detection records:

Timestamp (JST)	Event
Oct 7, 10:20	Initial malicious commit identified by StepSecurity
Oct 8, 10:12:07	tensorlake@0.5.144 published to npm registry
Oct 8, 10:23:10	Malicious package detected by Socket

The window between publishing and detection was 11 minutes and 3 seconds.
Much like the Keyv compromise in August, the attacker modified source files before invoking a legitimate GitHub Actions build workflow, resulting in valid provenance metadata attached to the tainted package.

Bun Runtime Launch and CI Evasion

The compromised package added a preinstall hook in package.json:

{
  "scripts": {
    "preinstall": "node lib/setup.mjs"
  }
}

The lib/setup.mjs script downloads Bun and executes the worm payload at lib/Math_Symbol.js.
In environments where lifecycle scripts are enabled, this code runs automatically during installation without requiring any SDK import.

StepSecurity reported that setup.mjs detects CI environments and aborts execution.
Endor Labs’ analysis also confirmed checks for environment variables such as CI and GITHUB_ACTIONS.
Because the loader skips execution when these variables exist, automated CI builds pass cleanly while installation on developer machines triggers the Bun runtime.

Targeting 14 Wallet Extensions and Browser Credentials

The 14 wallet extensions identified by Aikido include MetaMask, Phantom, Rabby Wallet, and Coinbase Wallet extension.
The payload extracts IndexedDB and LevelDB files stored locally by these extensions and transmits them to remote servers.

The malware also retrieves an operating-system-specific binary of HackBrowserData to collect credentials saved across web browsers.
These findings describe exfiltration capabilities identified in static and dynamic analysis, rather than confirmed balances stolen from infected systems.

Wallet theft was previously observed during the Mastra npm attack in June.
The Tensorlake release indicates that Shai-Hulud’s operators have expanded their payload capabilities to aggressively target browser and extension storage alongside traditional package propagation.

Security advisories differ on command-and-control infrastructure. Aikido reported a hardcoded domain (iseekaigogo[.]com) and fallback address lookups via Ethereum smart contracts, whereas Socket found no hardcoded C2 domains.
Both vendors agree on the smart contract lookup mechanism. When reviewing incident logs, the domain listed by Aikido remains a useful indicator of compromise.

Mitigation Order: Removing the Watchdog Before Token Revocation

StepSecurity discovered a persistent watchdog daemon named gh-token-monitor. It continuously checks the stolen GitHub token and wipes the user’s home directory if the token is revoked or invalidated.
Immediately revoking compromised tokens triggers this destructive payload on infected machines. Socket recommends isolating systems and removing the monitor before rotating credentials:

Step	Action
1	Inspect lockfiles, installation logs, and build artifacts for tensorlake@0.5.144, blocking further installations
2	Network-isolate infected systems, terminate gh-token-monitor, and purge malicious execution tasks added to .claude/settings.json and .vscode/tasks.json
3	Rotate leaked GitHub and npm tokens, cloud API keys, and browser credentials from a known-clean machine
4	Audit recent package releases and repository commits, then rebuild workstations from trusted sources

Rotating credentials from a separate machine aligns with GitHub’s security advisory.
However, revoking tokens remotely does not disable local background tasks on infected hosts; if gh-token-monitor remains active, it detects the authentication failure and executes the wipe. Machine isolation and process termination must come first.
Modifications to editor configurations were also seen during the @antv compromise in May, where persistent execution hooks remained active even after the offending npm package was removed.

Removal of Malicious Versions from the npm Registry

Tensorlake merged PR #1016 on October 8, reverting the malicious commits and adding CI checks to block unauthorized install scripts before future releases.
The project also enforced branch protection preventing direct commits to main even by administrators, and added mandatory multi-maintainer approvals for npm publications.

Querying npm registry metadata for version 0.5.144 as of October 13 returns HTTP 404 (version not found: 0.5.144), which confirms that the version was unpublished.
Because registry removal does not guarantee that local machines never fetched the package, checking lockfiles and package manager caches remains necessary to identify past installations.

Regarding the native binary packages (tensorlake-native-* version 0.5.144) built during the same workflow, Endor Labs inspected six packages and found no malicious code or install scripts.
However, the firm recommends avoiding these packages due to their association with the compromised release pipeline.