Attackers pushed malicious commits directly to the main branch of tensorlakeai/tensorlake under a maintainer's name, starting at 01:20 UTC on October 7, then let the repository's own release workflow publish tensorlake@0.5.144 to npm at 01:12 UTC on October 8. The package, a TypeScript SDK with more than 12,000 weekly downloads, carried a preinstall hook that runs an obfuscated loader and an 856 KB payload when developers install it. Because the build came from the real repo, the release even carried a valid npm provenance attestation. StepSecurity detected the release and reported it to maintainers in GitHub issue #1014.

A valid provenance attestation only proves where a package was built, not that the code is safe — and here the attacker corrupted the source first, then let the trusted pipeline vouch for the result. Socket, cited by news.lavx.hu, says the republished packages even carry Sigstore provenance, making poisoned versions look legitimately signed. The worm follows the ChainDrop campaign first documented in early August 2026, and extends it into AI agent infrastructure, where coding agents store MCP configuration, API keys and editor-level credentials on disk. Any machine that installed 0.5.144 must be treated as fully compromised.

StepSecurity's remediation is strictly ordered: never revoke a GitHub token until the monitor is gone. First check for the package with `npm ls tensorlake` and lockfile searches, then pin to 0.5.143, delete node_modules and clean the npm cache, and consider `ignore-scripts=true`. Look for `~/.config/gh-token-monitor/` and stop the service via systemctl on Linux, launchctl on macOS, or Task Scheduler on Windows. Only then rotate npm, GitHub, cloud, Vault, Kubernetes and SSH credentials and saved browser passwords. Endor Labs reports version 0.5.144 has since been removed from npm, and that the six tensorlake-native-* platform binaries contained no payload.

OX Security notes the Shai-Hulud name has become a brand that copycats reuse even after its original TeamPCP members were arrested in August, and that this wave uses new encryption public keys not connected to earlier variants, suggesting a new group or independent actor. Its researchers found five repositories uploaded with stolen credentials following this attack, alongside a wallet tied to an Ethereum contract holding about $12.44 in crypto. Worm-tagged packages may continue surfacing as stolen npm tokens are spent, so teams should watch lockfiles, GitHub Actions workflows referencing Copilot or Dependabot that nobody added, and any repos with the "Shai-Hulud" description.