An AI agent platform’s software development kit is the newest foothold for the credential-stealing Shai-Hulud worm, which researchers say has burrowed into a fresh npm release from Tensorlake.
Investigators found the intrusion inside version 0.5.144 of the Tensorlake SDK. That build pulls about 12,000 downloads every week, and its repository has passed the thousand-star mark, so a poisoned copy could reach a wide audience. Tensorlake runs a cloud-native service for executing isolated AI agents and untrusted code written by AI, and teams rely on the affected SDK to create and administer those environments.
Researchers tie this build to the Shai-Hulud strain they call ChainDrop. The same tooling was aimed at npm dependencies that included keyv and flat-cache in August. As with earlier versions of the worm, it hunts credentials and spreads itself.
Supply chain specialists at SafeDep report that this variant reaches for crypto wallets, browser passwords, GitHub Actions secrets, cloud credentials and service account tokens. Whatever it collects is shipped out over an open command-and-control channel that waits for further orders.
One behavior makes cleanup far harder. The strain watches specific stolen GitHub tokens, and revoking one can, under certain conditions, set off deletion of the victim’s home directory.
Socket’s guidance is to rebuild tainted machines from a trusted source before any secrets are restored. Its analysts also caution that the token monitor must be switched off before any credential revocation, since the destructive behavior can otherwise trigger. Anyone who installed the bad release should rotate every secret the host could touch, from cloud keys and CI tokens to credentials saved in a browser or wallet.
