TensorLake npm SDK Compromised in ChainDrop Shai

A compromise occurred in the TensorLake npm SDK version 0.5.144 through a ChainDrop / Shai-Hulud attack, resulting in credential-stealing malware being distributed. The compromised version contains an obfuscated payload designed to harvest credentials, exfiltrate secrets, establish persistence, and execute remote code. This exposure occurs when developers install the SDK on their systems before any generated code runs in an isolated sandbox.
The malicious installation process utilizes a preinstall hook that executes a script, specifically `node lib/setup.mjs`, which launches an obfuscated payload named `lib/MathSymbol.js`. This payload functions as a credential stealer and self-propagating worm. The malware targets a wide range of sensitive data across various systems, including npm tokens, GitHub tokens, AWS credentials, HashiCorp Vault data, Kubernetes secrets, SSH keys, and configuration files from AI development tools like Claude and Cursor.
The attack pattern mirrors previous ChainDrop/Shai-Hulud compromises, indicating the use of a standardized method for injecting code via `setup.mjs` loaders. The payload resolves its remote command-and-control endpoint via an Ethereum contract rather than hardcoded domains. A dead-man switch is implemented using a PowerShell monitor that checks GitHub token validity; if a token is revoked, it triggers a mechanism to wipe the system, ensuring persistence and self-destruction upon detection of compromise.

* TensorLake npm SDK version 0.5.144 was compromised via a ChainDrop / Shai-Hulud attack.
* The compromised version contains malware that harvests credentials, exfiltrates secrets, establishes persistence, and executes remotely supplied code.
* The malicious execution path is initiated by a preinstall hook: `"preinstall": "node lib/setup.mjs"`.
* The package contained two flagged files: `package/lib/setup.mjs` and `package/lib/MathSymbol.js`.
* The payload executes via the `setup.mjs` hook, using the `MathSymbol.js` loader.
* Credential harvesting targets include npm tokens, GitHub tokens, AWS credentials, HashiCorp Vault data (Kubernetes/AWS paths), SSH keys, and environment files (.env).
* The malware uses an Ethereum contract to resolve its command-and-control endpoint.
* A persistence mechanism includes a PowerShell monitor that polls GitHub for token validity; revocation triggers data wiping via Invoke-Expression.
* Indicators of Compromise include specific file SHA256 hashes for the malicious files.

The narrative describes a sophisticated supply chain attack exploiting a high-trust context—AI agent infrastructure—to pivot from code execution to credential exfiltration and lateral movement across an enterprise's entire secret landscape. The core pattern is the chaining of seemingly legitimate dependency lifecycle scripts (`setup.mjs`) to execute malicious logic, directly leveraging established malware patterns from previous campaigns (ChainDrop/Shai-Hulud). This demonstrates that infrastructure built around isolating code execution (sandboxes) does not inherently secure the installation process itself; the weakest link in the chain is often the dependency lifecycle hook.
The sophistication lies in the layered persistence and self-defense mechanisms. The payload's ability to spread through npm, enumerate publishing identities, and build Sigstore provenance echoes established malware propagation techniques, suggesting a coordinated playbook rather than an isolated exploit. Furthermore, the inclusion of specific triggers like the revocation check connected to destructive actions reveals an intent focused on ensuring long-term access while mitigating immediate detection by the victim.
The implication for cognitive sovereignty centers on re-evaluating trust at every stage of the software lifecycle—from dependency selection to installation context. If development and deployment environments are built on tools with complex dependencies, the assumption that localized environment security is sufficient breaks down when external, obfuscated code can execute during setup. The cost shifts from simply protecting secrets to understanding how the very mechanisms for building and deploying applications introduce exploitable pathways for systemic compromise.
Bridge Questions:
What unseen trust assumptions within CI/CD or developer tooling are being exploited by embedding execution paths in package manifests?
How can security frameworks evolve to audit dynamic runtime behavior initiated by preinstall hooks rather than solely focusing on static code analysis?
If the attack pattern is highly correlated across different tools, what systemic visibility gaps allow an attacker to assume a generalized methodology for compromising diverse software stacks?