tensorlake 0.5.144 npm package compromised to deliver Mini Shai-Hulud credential-stealing worm

Linha do tempo

1. safedep.io ↗ · pub. 07/10/2026 21:00 · coletado 19/10 18:03 primeiro registro

   tensorlake 0.5.144 npm package compromised to deliver Mini Shai-Hulud credential-stealing worm

   ler a análise desta fonte ocultar

   SafeDep identified a malicious tensorlake npm release, version 0.5.144 (about 106,000 monthly downloads), that ran a Mini Shai-Hulud worm on install. It was published at 01:12:07 UTC on 8 October and flagged by SafeDep eight minutes later. The attacker used a repository administrator account to commit the payload to main through the GitHub web interface, then manually triggered the project's own publish_npm.yaml release workflow with npm trusted publishing. The worm steals cloud, GitHub, npm, SSH, browser and wallet credentials, spreads through npm packages and GitHub repositories, and runs remote code from its C2 server. npm removed the version, and the maintainers reverted the source in PR #1016 and released 0.5.145.

   Technical Details

   • Delivery: eight web-interface commits, shown as verified because GitHub signs them, added a preinstall hook (node lib/setup.mjs). The first edit broke the JSON and was fixed 19 minutes later. The sibling tensorlake-native-*@0.5.144 packages carry valid SLSA provenance, but only for a build of poisoned source.
   • Loader: lib/setup.mjs uses RC4 string obfuscation and skips CI environments (CI, GITHUB_ACTIONS, GITLAB_CI). It downloads Bun 1.3.13 from the official GitHub release and runs lib/Math_Symbol.js (856,501 bytes, globalThis.WORMTAG = 'tensrlake').
   • Obfuscation: three layers: an obfuscator string array, a custom cipher with salt svksjrhjkcejg (same as in the keyv compromise), and AES-256-GCM over eleven embedded files, including two RSA public keys.
   • C2: POSTs to hxxps://iseekaigogo[.]com:443/router. Fallbacks are an Ethereum contract (0xb614155Fd88114d40549b259457Bcf921Df091B9, read through 35 public RPC endpoints), GitHub commits signed with an embedded RSA key and found by searching for thebeautifulmarchoftime, and dead-drop repositories described as Shai-Hulud: Here We Go Again.
   • Remote code: every C2 response can carry code that the worm runs with eval. After exfiltration it beacons every 45 to 90 seconds.
   • New in this build: hard-coded C2 domain, Ethereum contract lookup, a browser password stealer (arguments match HackBrowserData, an inference as the binary was not recovered), the remote code channel, and a deletion handler. The worm exits on Russian locales.
   • Destructive handler: gh-token-monitor checks the stolen GitHub token every 60 seconds for 24 hours, only when the account has no organizations. If GitHub returns 40x, for example after revocation, it runs rm -rf ~/ (or Remove-Item on Windows). It persists as a systemd user service, macOS LaunchAgent or Windows scheduled task.
   • Propagation: with npm tokens it injects the payload and preinstall into every publishable package, bumps the patch version and publishes. In CI with trusted publishing it adds a git dependency and signs with Fulcio and Rekor. With GitHub tokens it commits Claude Code and VS Code hooks as author claude and plants a Run Copilot workflow that dumps repository secrets, then deletes the run and branch.
   • Limits on spread: two bugs may limit it: the npm path needs ./dist/Math_Symbol.js on disk, and the planted loader looks for ai_init.js while the worm writes math_init.js.
   • CI run: the preinstall hook ended in 0.1 seconds in the release job, so the payload probably did not run on the runner (inference).

   Remediation

   • Remove gh-token-monitor (systemd service, LaunchAgent or scheduled task) before revoking any GitHub token, to avoid triggering home directory deletion.
   • Do not use tensorlake 0.5.144. Move to 0.5.145 or later and treat any host that installed 0.5.144 outside CI as compromised.
   • Rotate cloud, GitHub, npm, SSH, browser and wallet credentials from a clean system.
   • Audit repositories for unexpected Claude Code or VS Code hooks, Run Copilot workflows, commits authored as claude, and new public repositories described Shai-Hulud: Here We Go Again.
   • Block iseekaigogo[.]com and review npm packages published with your tokens for unexpected patch bumps.