Shai-Hulud Worm Compromised Tensorlake's AI Agent npm SDK

The Shai-Hulud Worm is back, and this time it went straight for the software that builds AI agents. On October 8, 2026, security researchers at Socket detected a compromised release of tensorlake, the TypeScript SDK for Tensorlake's AI agent infrastructure, carrying a credential-stealing Shai-Hulud Worm variant. Socket flagged version 0.5.144 at 01:23:10 UTC, just eleven minutes after its publication, and npm removed the release within roughly two hours. According to Socket, the malicious version contains obfuscated malware that harvests credentials, exfiltrates secrets, establishes persistence, and executes remotely supplied code.

Tensorlake is no obscure side project. The package sees about 12,000 weekly downloads and its GitHub repository has more than 1,000 stars, according to Socket. Tensorlake provides isolated sandboxes for running untrusted, LLM-generated code, with checkpointing, suspend, and resume capabilities, and the npm SDK lets developers create and manage those environments from TypeScript applications. As Socket's researchers pointed out, that creates a painful irony: a compromised SDK exposes the developer's own machine before generated code ever reaches the protective sandbox.

A valid signature on a poisoned package

The intrusion began a day before publication. According to a detailed security advisory on the attack, the attackers compromised a verified maintainer's GitHub identity around 01:20 UTC on October 7, 2026, and pushed a malicious commit directly to the project's main branch. The repository sat in that state for about twenty hours. Then the project's own automated release workflow did exactly what it was supposed to do: it built the code and published tensorlake@0.5.144 to the public npm registry on October 8 at 01:12:07 UTC.

Because the poisoned tarball traveled through the project's legitimate GitHub Actions pipeline, it shipped with a valid npm provenance attestation, according to the advisory. The package even showed build receipts proving the compromise had happened in the project's own infrastructure. For developers, that detail matters: the usual trust signals — verified provenance, official release channels — all checked out. The Shai-Hulud Worm variant rode in through the front door.

The Shai-Hulud Worm payload activates without any developer ever importing the SDK. The Shai-Hulud Worm release manifest contains a preinstall hook that runs lib/setup.mjs, an obfuscated loader that launches the main worm file, a roughly 856 KB script named Math_Symbol.js, using the Bun runtime, according to multiple reports on the compromise. Installation alone is enough; code run during installation inherits the installing process's permissions.

What the worm stole — and the hostage-token twist

According to The Hacker News's report on Socket's findings, the stealer is designed to harvest credentials across local files, CI environments, Kubernetes, and Vault sources. The reported haul spans npm tokens, GitHub tokens, Amazon Web Services credentials, HashiCorp Vault secrets, Kubernetes credentials, SSH keys, .env files, cryptocurrency wallets, and messaging app data. The malware also drops a HackBrowserData binary to exfiltrate the collected data, establishes persistence on the host, and supports the execution of remotely supplied code, according to The Hacker News.

The Shai-Hulud Worm variant also goes after the config and MCP files of AI coding tools — Claude, Cursor, Kiro, Windsurf, and Zed — according to the security advisory, planting editor-specific persistence that can survive the package's removal. Socket warned that the combination extends the risk beyond a single stolen API key, since any secrets accessible to the executing process may be exposed, according to The Hacker News.

Perhaps the most unsettling component is the "hostage token" mechanism. The Shai-Hulud Worm payload installs a gh-token-monitor service whose dead-man switch deletes the victim's home directory if the stolen GitHub token is revoked, according to the advisory. Standard incident response — revoke the compromised token first, ask questions later — becomes actively dangerous. Responders must disable the monitor before rotating anything, which is why the advisory's blunt guidance reads: isolate the host first, rotate credentials later.

Why agent infrastructure is the new bullseye

This attack continues a pattern. The Shai-Hulud Worm is an evolution of the ChainDrop attacks that hit the npm ecosystem in August 2026, compromising packages including keyv and cacheable, according to TechNadu. But this Shai-Hulud Worm incident marks a shift in targeting: instead of broadly-used utility libraries, the worm now seeks out the SDKs that developers use to build AI agents.

The logic is grim but sound. Agent developers are attractive targets because their machines concentrate exactly the credentials attackers want: cloud tokens, API keys, model provider secrets, and CI/CD access. Tools like agent identity and risk intelligence platforms have emerged precisely because autonomous software is becoming a first-class economic actor — and attackers are following the same trend lines, treating agent tooling as high-value infrastructure to compromise.

There is also a regulatory tailwind making this story bigger than one package. The UK's Information Commissioner's Office recently extended its AI scrutiny from models to autonomous agents, opening active enquiries after reports that deployed agents bypassed protections and accessed external systems. Supply-chain compromises like Tensorlake feed directly into that concern: if an agent's own SDK can be turned into an infection vector, the security perimeter moves from the model to the entire build pipeline.

What developers must do now

According to TechNadu, version 0.5.144 of tensorlake is no longer available for download from the npm registry, so new installations are not at risk from the registry itself. For anyone who may have installed it during the exposure window, the guidance is unusually specific. First, check for and disable the gh-token-monitor service before touching any credentials. Second, isolate the affected host rather than attempting remote remediation. Only then rotate every credential that process could have seen: npm and GitHub tokens, cloud credentials, SSH keys, Vault and Kubernetes secrets, and the configuration files of AI coding assistants.

Beyond the immediate triage, the attack revives an older lesson with new urgency. Provenance attestations verify that a package was built by a particular pipeline, not that the pipeline's inputs were clean. A compromised maintainer identity turns the entire release workflow into a distribution channel for malware. For teams building on AI agent SDKs, the Shai-Hulud Worm case shows why SDK updates deserve the same suspicion as any third-party code execution — pinning versions, auditing dependency scripts, and watching for preinstall hooks that have no business being there.

A supply chain problem bigger than one SDK

The maintainers merged a revert-and-harden pull request the same morning, according to the advisory, and the rapid detection — eleven minutes from publication to flag — shows the ecosystem's defenses are working faster than they did during the August wave. But speed of detection does not undo the installs that already happened, and persistence mechanisms like editor-config tampering are designed to outlive the cleanup.

The deeper question is structural. AI agent infrastructure sits at the intersection of two trends that the Shai-Hulud Worm operators clearly understand: developers granting agents broad credentials to act on their behalf, and supply chains optimized for velocity over verification. Until provenance is paired with identity hygiene for maintainers — hardware keys, mandatory reviews, anomaly detection on release pipelines — every agent SDK remains one compromised account away from becoming an attack vector. Socket caught this Shai-Hulud Worm release in eleven minutes. The next variant will be built on the assumption that defenders are counting on being that lucky again.