The install hook that brought its own runtime

At 01:12:07 UTC on October 8, 2026, the npm registry served tensorlake version 0.5.144 to any developer who ran a bare npm install against the Tensorlake SDK. Eleven minutes and three seconds later, Socket flagged the release as malware. In that gap, every CI runner, Docker build, and workstation that resolved the latest tag of Tensorlake's TypeScript SDK executed a preinstall script that downloaded a JavaScript runtime the host did not already have, and then ran a 856 KB obfuscated worm under it.

The campaign is a ChainDrop variant of Shai-Hulud, the npm worm family that keeps resurfacing with a new runtime trick each wave. The 0.5.144 release is a clean worked example of how a modern supply chain compromise reaches past the detections an installed-package scanner is wired to see.

The hook that fetched a runtime

The release manifest shipped a preinstall hook pointing at node lib/setup.mjs. A preinstall hook runs during npm install, before any require, before any test runner, before anybody imports the SDK into their code. The loader opens an outbound HTTPS connection, fetches the Bun JavaScript runtime, and uses it to execute lib/Math_Symbol.js. That second file is the payload, reported at roughly 856 KB of obfuscated JavaScript (The Hacker News, SafeDep).

A companion group of six tensorlake-native-* native-binary subpackages went out on the same 0.5.144 tag in the same automation run. Several analysts report the subpackages carry no payload of their own, but anyone who installed the SDK pulled them into the resolved tree all the same (Technadu).

Why launching the payload under Bun matters

Enterprise endpoint controls do not treat Bun the way they treat Node.js. SOC detections for supply chain compromise lean on Node process lineage, the known npm install child-process graph, and script-engine telemetry. Launching the payload under a freshly downloaded Bun binary instead of Node bypasses those detections cleanly, because the host was not configured with a Bun allowlist, because Bun was never installed, and because every EDR rule looking for anomalous Bun activity had nothing to compare against either (Aikido).

Bun also executes the payload directly from the downloaded binary. There is no interpreter configuration to flag, no module registration to subscribe to, and no package.json for the payload file itself. The main compiled executable swallows the obfuscated script and runs it without touching the ecosystem telemetry the rest of your stack is already instrumented to watch.

What the worm stole, and the hostage switch

The payload is Shai-Hulud genealogy, which means the credential list is wide. Reporting lists npm tokens, GitHub tokens, AWS and GCP credentials, Kubernetes config files, Vault tokens, SSH private keys, browser-stored passwords, cryptocurrency wallet material, and local AI tool configurations including Anthropic Claude keys and MCP server definitions (Socket, SafeDep).

A persistent background process keeps running on each infected host and watches whether the exfiltrated GitHub token is still valid. If that token gets revoked while the monitor is still running, the process attempts to delete the user's home directory. The dead-man's switch has shown up in prior Shai-Hulud waves, and it is why every incident guide this week leads with the same instruction: kill the monitor process on the host before you rotate any credentials (Aikido).

How a signed release went out under a maintainer's name

The malicious commit landed in the public Tensorlake GitHub repository on October 7 under a verified maintainer identity, with the commit hash 41b38f0. The commit bumped the release workflow trigger, which executed and published 0.5.144 to npm the next day through the project's own CI credentials (Aikido).

Because the publish went out through the maintainer's own release pipeline, the release carried a valid Sigstore provenance attestation. A downstream verifier could check the attestation and get a green answer back. The attestation says that tensorlake-ai/tensorlake built this artifact in GitHub Actions on the main branch. All of that was true. None of it told the verifier that the main branch had just received a malicious commit from somebody who was not supposed to have push rights, which is the same provenance-forgery pattern earlier Mini Shai-Hulud waves abused against unrelated packages (Snyk).

Why a CVE-first queue sees nothing

No CVE was issued for tensorlake 0.5.144. There is no NVD entry, no CVSS vector, and no vendor advisory in a form a CVE-matching scanner will consume. The package is also not a vulnerable version of a product in the traditional sense. It is a malicious release of a legitimate package, cleanly resolved by every registry client, with a short wall-clock window of roughly ten hours before npm removed it.

A pipeline tuned to CVE identifiers produced zero findings during that window and continued to produce zero findings afterwards, because once the version was yanked there was nothing left to query. The composition analysis tools that read your lockfile would have told you whether [email protected] was pinned somewhere, but only if you remembered to feed them that specific signal. Teams that waited on a CVE identifier before raising a queue entry raised nothing at all.

The exposed group is anyone who ran npm install tensorlake with a floating version range during the release window, anyone who installed from a lockfile generated during that window, and any build that trusted an npm cache populated during it.

TRIS layer walk for a package without a number

TRIS is the Threat and Risk Intelligence Scoring engine inside CVEasy AI. It is built to score an event like 0.5.144 without needing a CVSS vector to anchor to. Four layers decide the band this release lands in, and they are the layers CVE-matching pipelines do not read.

Confirmed exploitation. Yes. The release ran on every host that installed it. Reporting documents the full chain end to end from the preinstall hook through the Bun fetch through the Math_Symbol payload to the credential exfiltration and the dead-man's monitor. This is in-the-wild, not a proof of concept.

Blast radius through resolution. Any lockfile pinning or any floating range resolving tensorlake during the release window inherits the compromise. Downstream applications that embed Tensorlake, CI pipelines that install it on each run, and self-hosted n8n builds that pulled it as a transitive dependency are all in scope (DEV Community guide for n8n builders).

Real exposure beyond the registry fact. TRIS weights whether an affected host actually held credentials of interest to this payload. A developer laptop with a GitHub token, an AWS profile, and a local Anthropic key scores at the top of the queue (ACT band). A sandboxed single-use GitHub Actions runner with scoped read-only tokens and no persistent credentials scores lower on the same event. Same release, same CVE-less finding, different real exposure.

Attestation strength under attack. TRIS down-weights a provenance attestation that was signed by a build job triggered on an unaudited main-branch commit. The attestation is still readable and still valid cryptographically. The trust answer it returns is weaker because the commit history behind it does not survive adversarial review.

Patch, rotate, hunt

Fixed version is [email protected], published by the Tensorlake team after npm pulled 0.5.144 (The Register). The remediation sequence is non-obvious because of the hostage switch.

1. Kill the monitor first. On any host that installed 0.5.144, identify and terminate any background Node or Bun process consistent with the payload before revoking the exfiltrated GitHub token. The vendor write-ups linked above describe the monitor behavior; terminate the monitor, then revoke.
2. Grep every lockfile. Search package-lock.json, pnpm-lock.yaml, and yarn.lock across every repository the npm or GitHub credentials have ever touched, not only the one that owns the SDK. One compromised laptop can quietly republish other packages you own.
3. Rotate the full credential surface. npm tokens, GitHub tokens, AWS access keys, GCP service account keys, Azure principal secrets, Vault tokens, SSH keypairs, Kubernetes kubeconfigs, browser-stored credentials, and any Anthropic or local MCP server keys that lived on affected hosts.
4. Audit your own npm publishes during the window. Shai-Hulud propagates by republishing the victim's packages with the worm injected, and by committing backdoor files such as .claude/settings.json and .vscode/tasks.json to the victim's GitHub repositories. Diff your packages and your repo tree against last-known-good (Socket).
5. Pin direct dependencies to exact versions in production CI. A nightly build that resolves latest is the install shape that caught every Tensorlake user who installed inside the eleven-hour window (SafeDep).

How CVEasy AI surfaces this

A CVE-first scanner raised nothing on October 8. CVEasy AI, the number one local-first CTEM platform, ingests the raw sources this story lives in: Socket's malicious-package feed, the OpenSSF Malicious Packages database, SafeDep's compromise reports, and public researcher advisories as they publish. TRIS runs those signals against your installed inventory on your own hardware, scores the release by the four layers above, and surfaces the specific hosts that actually hold the credentials this payload went looking for. Your lockfiles, your CI metadata, and your SBOMs stay on your machines. You get the hunt list and the rotation list the moment the signal arrives, not when a CVE identifier finally gets written next week.

Sources: Socket, Aikido, SafeDep, The Hacker News, The Register, Technadu, DEV Community, Snyk, SC Media