Compromised npm Package Delivers Credential-Stealing Malware
The tensorlake npm package was hijacked to distribute the Shai-Hulud worm, which steals credentials and executes remote code. Developers are urged to verify package integrity immediately.
TL;DR
- The tensorlake npm package (v0.5.144) was compromised in a supply chain attack.
- Malicious code harvests credentials, exfiltrates secrets, and enables remote execution.
- Attack linked to the ChainDrop/Shai-Hulud malware campaign.
- Over 7,000 weekly downloads put many developers at risk.
- Organizations should audit dependencies and revoke exposed secrets.
A widely used npm package named tensorlake has been compromised in a sophisticated supply chain attack. Security researchers identified that version 0.5.144 of the TypeScript SDK includes obfuscated malware designed to steal credentials, leak secrets, and allow persistent remote access.
This incident is part of a broader campaign tracked as ChainDrop and Shai-Hulud, which targets developer ecosystems to gain unauthorized access to enterprise systems. With over 7,000 weekly downloads, the impact could be significant across development teams relying on this dependency.
How the Attack Works
- The malicious package version contains obfuscated JavaScript that runs post-installation.
- It scans the host environment for stored credentials, API keys, and cloud tokens.
- Stolen data is sent to attacker-controlled domains via HTTP requests.
- The malware achieves persistence by modifying shell profiles or startup scripts.
- Remote command execution capability allows attackers to maintain long-term access.
What Developers Should Do
- Immediately check if your project uses tensorlake version 0.5.144 and remove it.
- Audit all recent npm installations for suspicious activity or unknown packages.
- Revoke and rotate any secrets, tokens, or credentials that may have been exposed.
- Enable two-factor authentication (2FA) on all critical accounts and services.
- Use automated tools to monitor dependency trees for known malicious packages.
Sources
Sources
Security email updates
One digest email when we publish new security articles (TL;DR plus links to read more). Unsubscribe anytime from the message footer. See our Privacy Policy.