“Teams may isolate an agent’s generated code while installing its SDK on a developer workstation, application server, or build runner with access to deployment credentials and other secrets,” Socket warned.
Tensorlake SDK 0.5.144: a brief window of exposure
Security researchers reported that a malicious release of the npm package for Tensorlake’s SDK — version 0.5.144 — contained the credential-hijacking Shai-Hulud worm. That release was published earlier this morning, UTC, and Socket’s detection engine flagged it 11 minutes after publication. Npm removed the malicious version and Tensorlake pulled the package and updated the SDK to 0.5.145.
The infected package matters because of its reach: the compromised npm package is downloaded roughly 12,000 times per week, and the Tensorlake GitHub repository has more than a thousand stars, indicators of active use. The infected SDK is the component developers use to create and manage Tensorlake environments, so an infected install can place the malware on developer machines, build servers or other hosts with access to secrets and deployment credentials.
Shai-Hulud’s lineage: ChainDrop ties and prior supply-chain hits
Analysis of the malicious release shows shared code and techniques with a Shai-Hulud variant known to researchers as ChainDrop. ChainDrop was used in August to compromise npm dependencies including the keyv and flat-cache packages. Like those earlier compromises, the current variant is a credential-stealing worm that is designed to self-propagate through the software supply chain.
Nobody's watching your logs at 2 AM.
Full SOC coverage without building one. Nubivance deploys and manages Rapid7 InsightIDR and MDR for organizations that need detection and response, not another dashboard.
Get coverageCapabilities observed: what the malware takes and what it can do
Supply-chain security firm SafeDep reported that the malicious release is designed to steal a wide range of secrets: crypto wallets, browser passwords, GitHub Actions secrets, cloud credentials and service-account tokens — “and whatever else it can get its hands on,” according to the firm’s assessment. Researchers say the code exfiltrates stolen data and maintains an open line to command-and-control infrastructure to await further instructions.
Of particular concern is a token-monitoring component: the variant watches for certain stolen GitHub tokens and, under specific conditions, can trigger deletion of the infected user’s home directory if a monitored token is revoked. That behavior complicates remediation — revoking credentials without disabling the monitor can produce destructive side effects.
Installation context: why SDK installs can be more dangerous than they appear
Tensorlake is a cloud-native platform intended to run isolated AI agents and untrusted AI-authored code. But Socket cautioned that installing the Tensorlake SDK itself is an operation that can execute code on the installer’s machine or build server outside of the runtime sandbox protections that Tensorlake provides. “Code executed during that installation inherits the permissions of the installing process,” Socket noted — meaning an installation that runs with access to deployment credentials or other sensitive tokens can hand those secrets straight to malware before any agent isolation ever comes into play.
What this means for developer teams, CI/CD operators, and cloud owners
- Developer teams and security engineers should verify whether version 0.5.144 of the Tensorlake SDK was installed in development workstations, servers, or build runners; if compromise is confirmed, Socket recommends rebuilding affected systems from a trusted source before restoring secrets.
- CI/CD and build-runner operators must treat SDK installation as a high-risk step: because the malicious installer can execute outside sandbox boundaries, teams should audit build logs, rotate credentials cautiously, and — per researchers’ advice — disable any malicious token-monitoring component before revoking affected tokens to avoid triggering destructive actions.
- Cloud owners and DevOps teams should assume exfiltration is possible where the SDK ran with access to cloud credentials or service-account tokens and proceed with credential rotation, secret revocation, and integrity checks only after containment steps recommended by the responding researchers and tools.
The good news in this incident is the infection lived only briefly in the public npm registry: it was published and flagged within minutes, and npm and Tensorlake moved quickly to remove and replace the package. The bad news is the malware’s design — broad credential theft, persistent C2 connectivity, and a token monitor that can cause destructive file deletion — makes careless or hasty remediation risky.
Tensorlake users and organizations that integrate third-party SDKs into build and deployment pipelines should take two immediate steps: confirm whether 0.5.144 was installed in any environment with access to secrets, and follow Socket’s guidance to rebuild compromised hosts from a trusted source before restoring secrets. Researchers also emphasize disabling the token-monitoring component before revoking tokens to avoid triggering the malware’s destructive behavior.
For now, the incident is a clear reminder that supply-chain risk has moved into AI infrastructure: an SDK used to spin up isolated agents can, through its installer, reach out and touch the very credentials those agents were intended to be kept away from. How teams adapt their installation and CI/CD hygiene will determine whether this remains a short-lived anomaly or a recurring vector.
