Malicious build of Tensorlake npm package carries credential stealer

A compromised version of the npm package "tensorlake" has been found delivering credential-stealing malware, according to research from Socket reported on 8 October 2026.

The package is the TypeScript software development kit for Tensorlake applications, sandboxes and cloud services. Developers install it to build against Tensorlake's platform, which means the code runs on developer machines and in build systems rather than only in production.

Socket said the malicious release is version 0.5.144. According to the company, that version "contains obfuscated malware that harvests credentials, exfiltrates secrets, establishes persistence, and executes remotely supplied code". The compromise was described as part of what researchers are calling the ChainDrop, or Shai-Hulud, supply chain attack.

Each of those four behaviours matters on its own. Credential harvesting means the code looks for stored logins and tokens on the machine it lands on. Exfiltration means those secrets are sent somewhere the attacker controls. Persistence means the malware tries to survive a reboot or a reinstall. And remote code execution means the payload is not fixed: whoever controls the infrastructure can send new instructions after the initial install.

The risk profile for packages like this one is shaped by where they get installed. An SDK for an AI agent and document-processing platform is, by definition, used in environments that hold API keys for that platform and often for others alongside it. Continuous integration runners and developer laptops typically carry cloud credentials, registry tokens and source-control access. A package that quietly reads secrets at install time sits in a good position to collect all of them.

Socket, which publishes analysis of malicious packages in open source registries, is the source for the findings reported so far. The detail available at the time of writing is limited to the affected package name, the specific version and the described behaviour of the payload. No count of downloads or affected organisations has been published in the material reviewed, and no statement from Tensorlake has been reported.

Teams that use the Tensorlake SDK should check whether version 0.5.144 appears anywhere in their lockfiles, build caches or container images, not just in their current dependency list. Where it does, the conservative assumption is that any credential reachable from that machine has been exposed and needs rotating. Reinstalling a clean version of the package does not undo credential theft that has already happened, and it does not necessarily remove persistence mechanisms left behind on the host.

The incident is the latest in a pattern of attacks that target the npm registry as a route into developer environments. The appeal for attackers is the same each time: one poisoned release can reach many machines that are trusted by default.