Malicious Tensorlake Release Injects New Shai‑Hulud Worm into npm Ecosystem

On October 8, 2026, a compromised version of the popular Tensorlake npm package—version 0.5.144—was published to the public registry, carrying an updated variant of the self‑replicating Shai‑Hulud supply‑chain worm. Security researchers who first examined the code confirmed that the malicious payload was embedded directly in the package’s entry point, allowing it to execute automatically when developers install the module.

The worm is designed to harvest a range of developer credentials, including API keys and tokens that are often stored in environment files or browser‑based storage mechanisms. Once it obtains these secrets, the malware attempts to propagate by injecting itself into other dependent packages, creating a chain reaction that can spread across multiple projects that rely on Tensorlake.

This incident follows a growing pattern of attacks on the Node.js package ecosystem, where open‑source libraries are frequently targeted because of their wide adoption and the trust developers place in them. High‑profile supply‑chain compromises such as the 2021 event involving event-stream and the 2023 compromise of a popular build tool have highlighted the systemic risk posed by a single malicious package version.

Within hours of the discovery, npm removed the tainted release and issued an advisory warning users to audit any projects that may have pulled version 0.5.144. The original maintainers of Tensorlake posted a brief statement acknowledging the breach, noting that they are conducting a full investigation and recommending that affected developers rotate compromised secrets and review dependency lockfiles for unexpected changes.

Security experts say the episode underscores the need for stronger verification practices, such as using provenance metadata, adopting two‑factor authentication for publishing accounts, and employing automated tools that scan for anomalous code patterns. As the investigation continues, the broader developer community is urged to monitor npm advisories closely and consider implementing stricter dependency‑locking policies to mitigate future supply‑chain threats.