Recommended Free Tools
[email protected] was the malicious npm release reported on October 8, 2026. Its preinstall hook launched a Shai-Hulud-family credential-stealing worm during installation. If that version ran on a developer machine or CI host, treat credentials available to the installation process as potentially exposed—even though the malware’s intended targets do not prove that every secret was successfully stolen.
What happened to the Tensorlake npm package?
The legitimate tensorlake package, a TypeScript SDK for Tensorlake applications and services, received a malicious release numbered 0.5.144. Endor Labs reported that it was published at 01:12:07 UTC on October 8, 2026, and that versions 0.5.143 and earlier did not contain the malicious hook or payload. Endor Labs also reported that npm later removed 0.5.144.
As an Amazon Associate I earn from qualifying purchases.
The compromise mattered because npm package installation can execute package lifecycle scripts. A project did not need to import or call the SDK at runtime for the reported hook to run: installing the affected version could trigger it before the dependent application started.
Free tools Windows power users keep installed
One-click scans. No signup required.
How did the malicious release execute?
According to Endor Labs and Aikido Security, the package manifest added a preinstall script that ran node lib/setup.mjs. That loader invoked an obfuscated payload in lib/Math_Symbol.js using the Bun runtime. The sequence placed the code execution at installation time, subject to the environment’s package-manager configuration and whether lifecycle scripts were allowed to run.
#1 Best Overall
That timing is significant in both local development and automated builds: installation processes may have access to credentials and configuration that the package can attempt to read. Exposure depends on what was present and accessible on the particular machine or runner; the reporting does not establish that every installation yielded stolen data.
What did the worm target and attempt to do?
Vendor analyses describe a broad attempt to collect secrets from the environment. Reported targets included:
- npm and GitHub tokens, as well as other package registry and CI credentials;
- SSH keys, cloud credentials, Kubernetes and Docker configuration, and HashiCorp Vault tokens;
- environment files and other local secrets;
- browser data and cryptocurrency browser-extension data, which Aikido also reported as collection targets.
These are reported targets or attempted collection, not confirmation that each category was present, readable, or exfiltrated on every affected system.
The reporting also describes persistence and propagation attempts. Socket, as quoted by The Hacker News, said the worm enumerated packages associated with a victim’s publishing identity and attempted to republish compromised versions using stolen publishing credentials. Its account also described GitHub repositories and workflow files as part of its exfiltration or persistence behavior. StepSecurity researcher Ashish Kurmi was quoted describing the malware writing .claude/settings.json and .vscode/tasks.json files into reachable repositories to trigger execution when a project was opened in Claude Code or VS Code.
Rank #3
What should you do if you installed tensorlake 0.5.144?
Endor Labs recommends treating credentials accessible to a machine where the malicious release executed as potentially exposed. Use a clean system or trusted administrative session for response work, and proceed in this order:
- Find every installation path. Search lockfiles, dependency trees, package-manager caches, and build logs for
[email protected]. Check transitive dependencies as well as direct declarations, and include developer workstations and CI runners. - Stop further execution. Block or remove the affected release from dependency resolution and caches. Reinstall from a clean source using a verified version. Endor Labs identified
0.5.143as the clean preceding release at the time of its October 8 report; verify the version and package contents before relying on it. - Rotate credentials that were accessible. Prioritize npm and GitHub tokens, SSH keys, cloud credentials, registry and CI secrets, and credentials stored in environment files or tools available to the affected process. Revoke old credentials rather than merely changing local copies, and update legitimate systems that depend on them.
- Review account and repository activity. Look for unexpected package publications, token use, repository changes, newly added workflows, and other modifications tied to npm or GitHub identities that were available on the affected host.
- Assess the host and its outputs. Investigate affected machines or runners for unauthorized changes, including repository workflow and editor configuration files. Rebuild a CI runner or developer environment from a known-clean baseline if its integrity cannot be established.
- Revisit install-script policy. Consider disabling lifecycle scripts by default where practical, while allowing them only where a dependency genuinely requires them and the risk is understood.
These actions reflect vendor incident-response guidance; they are not a finding that any particular organization or machine was compromised.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How broad was the reported package scope?
Endor Labs reported six related tensorlake-native-* platform binary packages published in the same run. Its analysis found no payload in those binaries, but it advised avoiding them as part of the affected release set. Aikido reported no evidence, at the time of its October 8 analysis, of malicious Tensorlake publications to PyPI or Cargo. Those are time-bounded vendor findings, not a guarantee about later discoveries or every ecosystem.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →The precise initial access route was not confirmed in the reporting covered here. Vendor accounts characterized maintainer or release-path compromise as likely, but the available evidence does not establish how an attacker obtained access. Likewise, descriptions of what the worm was designed to collect do not show that every target was successfully exfiltrated.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
