Affected Systems

npm package "tensorlake" version 0.5.144 (TypeScript SDK for Tensorlake applications). Malicious version no longer available on npm registry. Affects users who installed this specific version, particularly those with access to CI/CD pipelines, cloud credentials, and AI development environments (Claude, Cursor, VS Code).

Exploitation Status

Active exploitation confirmed. Malicious version 0.5.144 was published to npm on October 8, 2026, following a repository compromise on October 7, 2026. The malware is fully functional with active C2 infrastructure (iseekaigogo[.]com) and data exfiltration to GitHub repositories. Self-propagating worm capability enables lateral spread to other npm packages owned by compromised maintainers.

Business Impact

Organizations using tensorlake 0.5.144 face credential theft across npm, GitHub, AWS, HashiCorp Vault, Kubernetes, SSH keys, .env files, cryptocurrency wallets, and AI tool configurations. The malware establishes persistence via preinstall hooks, .claude/settings.json, and .vscode/tasks.json files, surviving package removal. "Hostage token" component monitors for GitHub token revocation and triggers destructive payloads. Self-propagation risk means compromised maintainer accounts can infect downstream packages. AI development shops using Claude, Cursor, Windsurf, Zed, or VS Code face elevated risk due to targeted configuration file poisoning.

Urgency

🔴 Immediate

Recommended Actions

  • Audit all systems for tensorlake version 0.5.144 installation; remove immediately and check package-lock.json or yarn.lock for evidence of use
  • Rotate all credentials accessible to environments where tensorlake 0.5.144 was installed: npm tokens, GitHub PATs, AWS keys, Vault tokens, Kubernetes service accounts, SSH keys, and .env secrets
  • Search repositories for malicious .claude/settings.json and .vscode/tasks.json files; inspect package.json preinstall hooks and lib/setup.mjs or lib/Math_Symbol.js files
  • Monitor GitHub for unauthorized repositories with description 'Shai-Hulud: Here We Go Again' under your organization; check npm for unauthorized package publishes from compromised maintainer accounts
  • Block network access to iseekaigogo[.]com at perimeter and inspect logs for connections to this domain or GitHub API polling patterns indicative of hostage token monitoring

---

# Threat Actor Context

Actor Profile

ChainDrop is a supply chain threat actor first documented in August 2026, focused on compromising npm packages to distribute the Shai-Hulud credential-stealing worm. The actor's motivation centers on large-scale credential harvesting and establishing persistent access across software development environments. ChainDrop operates by compromising maintainer accounts or repositories to inject malicious code into legitimate packages, leveraging the trust inherent in open-source ecosystems. The group demonstrates sophisticated understanding of CI/CD pipelines, AI development tooling, and blockchain-based C2 infrastructure.

TTPs (Tactics, Techniques, Procedures)

Initial access achieved through compromise of npm package maintainer accounts (T1195.001 - Supply Chain Compromise: Compromise Software Dependencies and Development Tools). Malware deployed via preinstall hooks executing obfuscated JavaScript loaders using Bun runtime. Credential harvesting targets npm tokens, GitHub tokens, AWS credentials, HashiCorp Vault, Kubernetes secrets, SSH keys, .env files, cryptocurrency wallets, and AI tool configurations (T1552.001 - Unsecured Credentials: Credentials In Files). Persistence established through .claude/settings.json and .vscode/tasks.json files, plus GitHub Actions workflows (T1543 - Create or Modify System Process, T1053.006 - Scheduled Task/Job: Systemd Timers). C2 infrastructure resolved via Ethereum smart contract with GitHub fallback for data exfiltration (T1071.001 - Application Layer Protocol: Web Protocols). Self-propagation achieved by enumerating victim's npm publishing identity and republishing compromised package versions with Sigstore provenance (T1080 - Taint Shared Content). PowerShell-based "hostage token" monitor detects credential revocation and triggers destructive routines via Invoke-Expression (T1059.001 - Command and Scripting Interpreter: PowerShell, T1485 - Data Destruction).

Targets & Patterns

ChainDrop specifically targets software development organizations and individual developers within the npm ecosystem, with particular focus on AI/ML infrastructure providers. The October 2026 tensorlake compromise (version 0.5.144) targeted users of Tensorlake's TypeScript SDK for AI applications, sandboxes, and cloud services. The actor demonstrates strategic targeting of high-value development environments where credentials provide access to cloud infrastructure, CI/CD pipelines, Kubernetes clusters, and HashiCorp Vault secrets. The malware's focus on harvesting configurations from AI coding assistants (Anthropic Claude, Cursor, Kiro, Windsurf, Zed) and MCP files indicates deliberate targeting of organizations adopting AI agent infrastructure. Previous ChainDrop campaigns in August 2026 compromised hundreds of packages including Keyv and Cacheable, suggesting broad opportunistic targeting combined with strategic interest in widely-used dependencies. The self-propagating worm mechanism amplifies impact by automatically compromising additional packages associated with victim maintainer accounts.

Historical Context

ChainDrop was first documented in early August 2026 when hundreds of npm packages were compromised with a Mini Shai-Hulud variant. The initial wave targeted popular packages including Keyv and Cacheable, delivering self-propagating credential-stealing worms through obfuscated Bun-based JavaScript payloads. The October 2026 tensorlake compromise represents an evolution of ChainDrop tactics, extending attacks into AI agent infrastructure and demonstrating refined techniques including Ethereum-based C2 resolution, Sigstore provenance manipulation, and "hostage token" monitoring with destructive payback mechanisms. Earlier Shai-Hulud waves exhibited similar destructive routines triggered upon credential revocation. The consistent use of obfuscated Bun runtime loaders, preinstall hooks, and self-propagation via npm publishing identity enumeration indicates operational continuity across campaigns. The progression from general-purpose npm packages to AI development tooling suggests strategic adaptation to emerging technology sectors.

Defensive Recommendations

  • Implement npm package integrity verification using Sigstore signatures and monitor for unexpected preinstall/postinstall script execution in package.json files
  • Deploy file integrity monitoring to detect unauthorized creation of .claude/settings.json, .vscode/tasks.json, and suspicious GitHub Actions workflows in repositories (T1543, T1053.006)
  • Monitor for Bun runtime execution in CI/CD environments and flag obfuscated JavaScript files, particularly those accessing credential stores or environment variables (T1552.001)
  • Detect PowerShell Invoke-Expression cmdlet usage polling api.github.com/user in loops, indicative of hostage token monitoring behavior (T1059.001)
  • Implement network monitoring for connections to Ethereum RPC endpoints used for C2 resolution and block exfiltration to public GitHub repositories with Shai-Hulud-related descriptions (T1071.001)
  • Enforce least-privilege npm publishing tokens scoped to specific packages and enable GitHub token expiration policies to limit exposure from credential theft
  • Audit installed npm packages for version 0.5.144 of tensorlake and rotate all credentials (npm, GitHub, AWS, Vault, SSH keys) if exposure detected