Shai-Hulud worm jumps to AI infrastructure by compromising Tensorlake's npm package

[Oliver87]

The credential stealing Shai-Hulud worm has infected a release of Tensorlake's SDK on npm, The Register reports. Tensorlake is a platform for running isolated AI agents and untrusted AI generated code. Version 0.5.144 of its npm package was the one affected. The package gets about 12,000 downloads a week and its GitHub repository has more than 1,000 stars

Researchers at Socket and SafeDep reported the infection. Socket's scanning engine flagged the bad version just 11 minutes after it was published. npm removed it and Tensorlake released a clean version, 0.5.145. That is a quick response, but anyone who installed in that window could still be affected

The malware shares code with the ChainDrop variant used against the keyv and flat-cache packages in August. It goes after crypto wallets, browser passwords, GitHub Actions secrets, cloud credentials and service account tokens. Socket says it exfiltrates that data and keeps an open line to its command server to await further instructions. In other words, it is not a smash and grab but a lingering presence

There is a nasty trap for victims. If certain stolen GitHub tokens are revoked, the malware can delete the victim's home directory. Researchers advise disabling its token monitor before revoking credentials. Socket also recommends rebuilding compromised systems from a trusted source before restoring access to any secrets

The irony here is hard to miss. Tensorlake exists to run untrusted code safely in a sandbox, but the install script runs outside that sandbox on developers' machines or build servers. As Socket put it, code executed during installation inherits the permissions of the installing process. Supply chain attacks keep hitting the npm ecosystem, and AI tooling is now a juicy target

Do you pin package versions or let them update automatically? And should npm do more to stop install scripts running by default?

Shai-Hulud worm makes jump to AI infrastructure with Tensorlake compromisewww.theregister.com