The Shai-Hulud supply-chain wave turns trusted npm packages into credential thieves. Malicious package versions fire their payload from the package's install script — before your application code ever runs — and harvest npm tokens, GitHub tokens, AWS keys, Vault tokens, Kubernetes credentials, SSH keys, .env files and crypto wallets from developer machines and CI runners (per Socket's analysis). The latest wave hit the tensorlake AI SDK: version 0.5.144, published October 8, 2026, ran a preinstall hook executing an obfuscated loader (lib/setup.mjs) that launched the worm (lib/Math_Symbol.js) with the Bun runtime. Earlier waves pushed 84 malicious versions across 42 @tanstack/* packages in six minutes, and planted persistence hooks in .claude/settings.json so the malware survived package removal. This free guided 8-step self-audit walks you through checking your own dependencies and CI for the signs. It's a guided audit you perform yourself — it does not scan your machine.
Key figure: Reported cybercrime losses in the United States reached $16.6 billion in 2024, up 33% from 2023 (FBI IC3, 2024 Internet Crime Report).
Shai-Hulud is the name of a 2026 npm supply-chain attack wave in which malicious package versions stole developer credentials through install hooks.
npm install → the package's preinstall/install/postinstall hook executes attacker code before any of your code runs.~/.npmrc tokens, GitHub tokens, SSH keys, AWS/GCP credentials, cloud metadata endpoints, Vault, loose .env files..claude/settings.json SessionStart hooks, .vscode/tasks.json backups, commits titled chore: update dependencies pushed to your repos with stolen GitHub tokens.Tick each step as you complete it. Progress is saved on this device only (localStorage) — nothing is sent anywhere.
0 of 8 steps complete
This is a guided self-audit, not an automated scanner: you run the commands on your own machine, and nothing about your project leaves your browser. Informational only, not security advice.
lib/setup.mjs) plus an ~856KB worm file (lib/Math_Symbol.js). Legitimate install scripts are readable; walls of encoded text are not..claude/setup.mjs, new SessionStart entries in .claude/settings.json, or .vscode/tasks.json tasks you didn't write.By turning trust into a weapon. Attackers published malicious versions of legitimate packages, and preinstall hooks executed the moment developers ran npm install — harvesting credentials and spreading laterally. It hit the exact layer everyone assumed was safe: the dependency tree. This check walks you through eight audit steps to determine whether your node_modules carried the payload.
Shai-Hulud is a self-propagating npm supply-chain worm family. In documented waves — including May 2026 and a September/October 2026 wave — attackers published malicious versions of legitimate packages (e.g. tensorlake@0.5.144 on October 8, 2026). The payload fired from the package's install script during npm install, stole credentials from the machine, and used stolen npm tokens to republish poisoned versions of packages the victim could publish to. Analysts including Socket, JFrog, Microsoft, Snyk and StepSecurity have tracked the campaign.
Per Socket's analysis of the tensorlake compromise: npm tokens, GitHub tokens, AWS credentials and secrets, HashiCorp Vault tokens, Kubernetes credentials, SSH keys, .env files, cryptocurrency wallets and messaging-app data — anything accessible to the process running the install.
Researchers found the worm planted persistence outside node_modules: a SessionStart hook in .claude/settings.json pointing at a dropped .claude/setup.mjs script, a backup .vscode/tasks.json task that runs when the folder opens, and commits of those configs to reachable repositories via stolen GitHub tokens. Some variants also enrolled the host as a self-hosted GitHub Actions runner. Removing the malicious package alone did not remove these hooks.
Run the 8-step self-audit above: review recent dependency updates, inspect package.json lifecycle scripts across the tree, read any install script before trusting it, check for planted hook files (.claude/settings.json, .vscode/tasks.json), review lockfile diffs, rotate secrets that were visible during installs, and going forward use lockfiles, npm's ignore-scripts option, and 2FA on your npm account.
Check exactly which versions you installed against the flagged versions (e.g. tensorlake@0.5.144) and when. If you installed a malicious version, assume any credential accessible during the install was exfiltrated — rotate npm tokens, GitHub tokens, cloud keys and everything in .env files — and inspect your repos for planted hook files and commits you did not make.
The Hacker News report (October 2026) carries Socket's technical breakdown of the tensorlake compromise: the preinstall hook, the obfuscated loader, and the full credential-theft target list.