On October 8, 2026, someone published version 0.5.144 of the Tensorlake SDK to npm, an infrastructure platform for AI agents. It carried a Shai-Hulud worm variant that runs just by installing the package. Socket caught it 11 minutes later, but the malware’s design leaves an uncomfortable lesson for any team working with agents.
According to Socket’s analysis, the malicious version 0.5.144 of the tensorlake package was published to npm on October 8, 2026 at 01:12:07 UTC and flagged at 01:23:10 UTC, about 11 minutes later. npm pulled the version and Tensorlake published 0.5.145. SafeDep also reported the compromise, according to The Register.
The Register adds that the package gets around 12,000 weekly downloads and its repository has over 1,000 GitHub stars. Be careful not to misread that figure: those are the package’s overall downloads, not how many machines installed the malicious version in those 11 minutes, a number we haven’t seen published.
The trick isn’t in the SDK’s code but in npm’s install lifecycle. A preinstall script runs during npm install, before anyone imports the library or starts an agent. That puts the risk on developer laptops, CI runners and build servers, exactly where credentials live.
Socket describes a payload that collects AWS, Kubernetes and HashiCorp Vault credentials, GitHub and npm credentials, configuration for developer tools such as Claude, Cursor and Zed, plus SSH keys, .env files and crypto wallets. SafeDep and The Register add browser passwords, GitHub Actions secrets and service-account tokens. It also establishes persistence and allows remote code execution.
Shai-Hulud is a supply-chain worm: with the publishing tokens it steals from a victim, it can compromise other packages under that person’s identity, hopping from project to project. The Register recalls that the same ChainDrop variant was used in August 2026 against the keyv and flat-cache dependencies.
Agent tooling is the new favorite target because those machines hold many keys: cloud, repositories, LLM keys. Three concrete actions: (1) disable automatic install scripts in CI when possible (--ignore-scripts) and pin versions with a lockfile; (2) don’t give build runners more permissions than needed, since a single exposed .env hands over everything; (3) have an incident runbook that explicitly states the order of rotation, so you don’t trigger a destructive switch. If Guatemalia can help review your agent pipeline, write to info@guatemalia.com.
Carlos Montiel is an enterprise AI solutions architect. He implements LLMs, Agents, RAG, and orchestrators for companies across Guatemala and Latin America. Reach out for a consultation.
Contact Carlos Montiel