← Back to feed
2026-10-09 Supply ChainMalware TLP:CLEAR

StepSecurity Details Destructive Hostage Token in Tensorlake 0.5.144 Worm

Date: 2026-10-09
Tags: supply-chain, malware

Executive Summary

StepSecurity published new technical analysis on October 8, 2026 showing the compromised tensorlake npm package version 0.5.144 installs a background service named gh-token-monitor that checks a stolen GitHub token every 60 seconds for up to 24 hours and runs rm -rf ~/ (or a PowerShell delete of the user profile on Windows) if GitHub rejects the token. This means revoking the stolen token is what triggers destructive action, so defenders must isolate the host before revoking. The package also self propagates by republishing stolen npm packages and by committing to victim GitHub repositories.

Campaign Summary

FieldDetail
Campaign / MalwareChainDrop Shai-Hulud tensorlake worm
AttributionUnknown, Shai-Hulud linked supply chain operator (confidence: medium)
TargetDevelopers and CI systems installing the tensorlake npm SDK
VectorMalicious npm release with a preinstall hook
Statusactive
First Observed2026-10-08

Detailed Findings

According to stepsecurity.io, the malicious commit landed on main at 01:20 UTC on October 7, 2026 under a maintainer identity, followed by seven more commits over the next hours that tweaked the payload and added a preinstall line to package.json, with none going through a pull request. The repo release workflow published 0.5.144 to npm at 01:12 UTC on October 8, and the npm package files match main. StepSecurity reported that the payload targets GitHub and npm tokens, cloud keys, Kubernetes and Vault secrets, SSH keys, saved browser logins, and config files for AI tools including Claude, Cursor, and Windsurf, encrypts the data, and sends it to a public GitHub repo it creates in the victim account with the description 'Shai-Hulud: Here We Go Again' or to iseekaigogo.com. The report states that with a stolen npm token it downloads the victim's packages, adds itself, bumps the version, and republishes, and with a stolen GitHub token it commits .claude and .vscode files to victim repos using a fake [email protected] author and the message 'chore: update dependencies'. StepSecurity further reported that when the malware has a GitHub token it installs a service named gh-token-monitor that checks the token against the GitHub API every 60 seconds for up to 24 hours and, if GitHub rejects it, runs rm -rf ~/ or a PowerShell delete of the user profile on Windows. StepSecurity's AI Package Analyst detected the release and reported it to maintainers in GitHub issue #1014. Socket separately reported the same release as a ChainDrop Shai-Hulud event.

MITRE ATT&CK Mapping

TechniqueIDContext
Compromise Software Supply ChainT1195.002Malicious npm release and republishing of stolen packages spreads the worm
Data DestructionT1485gh-token-monitor runs rm -rf ~/ or deletes the user profile when the stolen token is revoked

IOCs

Domains

iseekaigogo.com

Full URL Paths

_IOCs condensed from the StepSecurity writeup; malicious files in the package are lib/setup.mjs (obfuscated preinstall loader) and lib/Math_Symbol.js (worm payload) per Socket's writeup_

Splunk Format

"iseekaigogo.com"

Package Indicators

npm:[email protected]

Affected Platforms

npm
Node.js
Windows
Linux
macOS

Detection Recommendations

If tensorlake 0.5.144 was installed, do not simply revoke the stolen GitHub token first: isolate the host from the network and kill any gh-token-monitor scheduled task, launch agent, or service before revoking, then uninstall the package version. Hunt for the exfil domain iseekaigogo.com, for GitHub repos described as 'Shai-Hulud: Here We Go Again' in victim accounts, for commits authored as [email protected] with the message 'chore: update dependencies', and for reads of .claude and .vscode directories. Rotate npm, GitHub, cloud, Kubernetes, Vault, and SSH credentials from a clean host.

References