Embedded Malicious Code Affecting tensorlake package, versions =0.5.144

tensorlake is a TensorLake SDK for applications, sandboxes, and cloud services

Affected versions of this package are vulnerable to Embedded Malicious Code that contains a credential-stealing worm known as Shai-Hulud. A malicious actor used a repository administrator account to commit the payload directly to the project's main branch via the GitHub web interface; This allowed the attacker to trigger the project's automated release workflow and publish the compromised version 0.5.144 of the tensorlake package to npm.

The malware is triggered via a preinstall script that drops the Bun runtime to execute an obfuscated payload. It is designed to establish communications with a hardcoded command-and-control (C2) server (iseekaigogo[.]com) and can also resolve an alternate C2 via an Ethereum smart contract. The worm aggressively exfiltrates sensitive environment variables, cloud credentials, SSH keys, browser stores, and cryptocurrency wallets. It also attempts to self-replicate through connected supply chains, spreading into other npm packages and GitHub repositories accessible from the infected machine.

• The payload heavily targets browser stores, attempting to exfiltrate IndexedDB and LevelDB files related to at least 14 cryptocurrency browser extensions.

• Kill Switch: The malware contains a "dead-man's switch" deletion watcher. If the hardcoded, stolen GitHub token embedded within the worm is ever revoked, the malware will execute a destructive command (rm -rf ~/) to wipe the user's home directory.

• Any system or environment infected by this version should be treated as fully compromised, and all exposed secrets or credentials must be rotated as a critical priority.

• Aikido Blog Post
• GitHub Issue
• OX Security Blog
• SafeDep Blog