Tensorlake npm 0.5.144: malicious install hook

A malicious Tensorlake AI SDK release added a preinstall loader. The maintainer confirmed direct-to-main changes and hardened publishing; GitHub's malware advisory says hosts where it ran must be treated as compromised. Responders link its loader pattern to the ChainDrop/Shai-Hulud family; GitHub’s advisory does not make that attribution.^{[1], [2], [3], [4], [5]}

💡 Plain English Explainer (ELI5)

Installing this package was like plugging in a device that starts running as soon as it gets power: you did not need to press a button or use it. npm ran the malicious preinstall hook with the installer's permissions before anyone imported the SDK.^{[3], [6], [1]}

Core Concepts & Subsystem Terms

preinstall lifecycle hook: A package script npm can run during installation. The published Tensorlake 0.5.144 manifest invoked a loader from this hook, so importing the SDK was not required.^{[1], [6]}
provenance attestation: Evidence about where and how an artifact was built. Tensorlake's maintainer says the malicious release had npm provenance; provenance does not establish that the source code was benign.^{[2], [3]}
install-script tripwire: A CI check that fails when a published manifest declares install lifecycle scripts. Tensorlake added one alongside npm ci --ignore-scripts after the incident.^[3]
Campaign-family attribution: StepSecurity and Socket associate the loader pattern with ChainDrop/Shai-Hulud. The GitHub malware advisory does not name a campaign family, so treat this as responder attribution.^{[4], [5], [1]}

Framework mappings

CWE reference for the weakness described in this guide: CWE-506

Incident Timeline

October 7, 2026

The maintainer's incident response says commits were pushed directly to the repository's main branch under a repo-admin account.^{[2], [3]}

October 8, 2026

The release workflow published malicious tensorlake@0.5.144; the maintainer says npm later removed it.^{[1], [2]}

October 8, 2026

The maintainer merged PR #1016, reverted to the last clean commit, added install-script controls, and bumped the clean release to 0.5.145.^{[3], [7]}

Step-by-Step Attack Flow

Step 1

Repository trust was bypassed

The maintainer's incident PR reports direct commits to main under a repo-admin account, outside the normal pull-request review path. The release was then manually dispatched from that repository.^{[2], [3]}

Step 2

The package ran code during install

Responders found a preinstall hook that launched a loader in tensorlake@0.5.144. npm lifecycle execution gave it the installing process's access; a consumer did not need to import the SDK first.^{[1], [4], [5], [6]}

Step 3

Host credentials and persistence were at risk

GitHub's malware advisory says an affected host must be treated as fully compromised. StepSecurity and Socket report credential theft and persistence, including a monitor that could react destructively to token revocation. Attribute those payload details to the responders; do not assume every listed capability ran on every host.^{[1], [4], [5]}

Step 4

The maintainer restored release controls

The response reverted the malicious commits, added npm ci --ignore-scripts and a manifest tripwire to workflows, tightened repository and publishing protections, and superseded the package with 0.5.145. The GHSA itself lists no patched version because it tracks malware, not a normal vulnerable code range.^{[3], [7]}

Source Code: Flaw vs. Secure Implementation

This CI comparison follows the maintainer's merged PR #1016; it is not the malicious package or an exploit. The tripwire runs before installation and rejects published install hooks, while ignore-scripts prevents npm ci from running dependency lifecycle scripts. The project reported that its checks and SDK build worked with this setting. It can affect packages that require install hooks, and explicitly invoked commands such as npm test still run their intended scripts. Keep later build steps isolated and do not treat provenance alone as a source review. The excerpt is partial: the maintainer's tripwire also rejects unexpected files under typescript/lib/, in addition to checking install-hook declarations.^{[3], [6]}

UNPATCHED FLAW

steps:
  - run: npm ci

HARDENED SECURE PATCH

steps:
  - run: node scripts/check-no-install-scripts.mjs
  - run: npm ci --ignore-scripts

Engineering & System Hardening Checklist

✓Search manifests, lockfiles, caches, and build records for tensorlake@0.5.144. The advisory identifies that exact npm version; do not infer exposure from the package name alone.^[1]
✓If installation ran, isolate the host from networks and preserve evidence. Removing the dependency does not prove persistence or other changes are gone; rebuild from trusted media when integrity cannot be established.^{[1], [4], [5]}
✓While the host remains isolated, coordinate with incident responders to identify and remove the reported token-revocation-triggered persistence before revoking or rotating tokens. Researchers report that revocation could trigger destructive behavior; follow current responder guidance and perform response actions from clean systems.^{[4], [5]}
✓After responders address the reported persistence, use a clean system to revoke and rotate credentials the installer could access. Review reachable repositories and package releases, and inspect CI artifacts and audit logs for unauthorized changes.^{[4], [5], [3]}
✓In CI, run a reviewed install-script tripwire before dependency installation, use npm ci --ignore-scripts where compatible, isolate explicitly required build scripts, remove direct-push/admin bypasses, and require independent approval for package publication.^{[3], [6]}
✓As of 2026-10-12, verify whether your environment installed any of these six companion packages at 0.5.144: `tensorlake-native-* family: tensorlake-native-linux-x64-gnu, tensorlake-native-linux-x64-musl, tensorlake-native-linux-arm64-gnu, tensorlake-native-linux-arm64-musl, tensorlake-native-darwin-arm64, tensorlake-native-win32-x64. The npm registry returned version metadata for each on that date, so treat them as still published and include them in exposure inventory. This confirms registry availability only; it does not establish that a companion package contained the incident payload. The maintainer said in merged PR #1016 that these versions still needed to be unpublished at that time.^{[3], [8], [9], [10], [11], [12], [13]}