Shai-Hulud worm jumps to AI infrastructure by compromising Tensorlake's npm package

[Oliver87]

The credential stealing Shai-Hulud worm has infected a release of Tensorlake's SDK on npm, The Register reports. Tensorlake is a platform for running isolated AI agents and untrusted AI generated code. Version 0.5.144 of its npm package was the one affected. The package gets about 12,000 downloads a week and its GitHub repository has more than 1,000 stars

Researchers at Socket and SafeDep reported the infection. Socket's scanning engine flagged the bad version just 11 minutes after it was published. npm removed it and Tensorlake released a clean version, 0.5.145. That is a quick response, but anyone who installed in that window could still be affected

The malware shares code with the ChainDrop variant used against the keyv and flat-cache packages in August. It goes after crypto wallets, browser passwords, GitHub Actions secrets, cloud credentials and service account tokens. Socket says it exfiltrates that data and keeps an open line to its command server to await further instructions. In other words, it is not a smash and grab but a lingering presence

There is a nasty trap for victims. If certain stolen GitHub tokens are revoked, the malware can delete the victim's home directory. Researchers advise disabling its token monitor before revoking credentials. Socket also recommends rebuilding compromised systems from a trusted source before restoring access to any secrets

The irony here is hard to miss. Tensorlake exists to run untrusted code safely in a sandbox, but the install script runs outside that sandbox on developers' machines or build servers. As Socket put it, code executed during installation inherits the permissions of the installing process. Supply chain attacks keep hitting the npm ecosystem, and AI tooling is now a juicy target

Do you pin package versions or let them update automatically? And should npm do more to stop install scripts running by default?

Shai-Hulud worm makes jump to AI infrastructure with Tensorlake compromisewww.theregister.com

[Keira85]

Packages for AI tooling are a perfect target. They are new, popular and often installed on machines with cloud credentials

Developers in a hurry to try the latest agent framework do not always check what they are installing. Attackers know that. New ecosystems always have weaker security habits. Rushing to try new tools is how people get caught

[TheRock25]

Shai-Hulud is a great name for a worm, at least. Dune fans in the security community clearly had fun. The damage is no joke, though

This family has been causing trouble for over a year now. The sandworms would be proud

[Enterprise]

Pinned versions and a lockfile, always. Automatic updates on dependencies are asking for trouble with attacks like this

Review the changelog, then update on purpose. It is slower but much safer

Boring practices prevent exciting incidents. Dependabot style tools help keep it manageable

[TrainingRun Anvil]

Install scripts running by default is npm's biggest weakness. Other package managers have moved towards disabling them or asking first. npm keeps the old behaviour for compatibility. Every one of these worms takes advantage of it

pnpm and others have shown it can be done differently. Compatibility excuses are wearing thin