On October 8, 2026, the npm package tensorlake@0.5.144 was published with a Shai-Hulud worm payload: a preinstall hook ran the moment anyone installed it — no import needed — and it harvested developer secrets. Run the 8 steps below against your own projects. 15 minutes, real commands, honest verdict.
Sources: Huntaegis incident write-up · GBHackers · Badger Signal · Anomali Cyber Watch · dev.to timeline.
Run each command in your project root, then mark what you found. The real malicious-lifecycle-hook patterns below match Ingenious AI's npm-lifecycle-hook-auditor rules (WORMTAG marker, setup.mjs/Math_Symbol.js loaders, Bun-runtime invocation).
npm removed tensorlake@0.5.144, but your lockfile may still pin it — or the six tensorlake-native-*@0.5.144 binary packages from the same release run.
Any package can declare preinstall/install/postinstall hooks. Most are benign — but this is how the worm runs, so look at every hit with fresh eyes.
The October tensorlake payload tagged itself with globalThis.WORMTAG='tensrlake'. A WORMTAG hit in installed code is a worm marker — case-insensitive.
The tensorlake loader chain used setup.mjs plus the ~856 KB second stage (reported spellings: Math_Symbol.js / MathSymbol.js).
The loader downloaded the Bun runtime specifically to dodge Node-focused detection. Bun in an install path deserves an explanation.
The worm exfiltrates to a public GitHub repo it creates in your account ("Shai-Hulud: Here We Go Again") and republishes your packages using your stolen npm token. Look for repos and publishes you didn't make, and unexpected login sessions.
The tensorlake attack entered through commits pushed directly to main outside pull requests (~01:20 UTC Oct 7), then the project's own release pipeline shipped it. Audit your own repo the same way.
If you installed a confirmed-poisoned release: kill the worm's token-monitor process FIRST, then rotate credentials. Security researchers documented a dead-man switch — revoking a stolen GitHub token while the monitor still runs triggers a home-directory wipe. Rotate npm, GitHub, cloud, Kubernetes, Vault and SSH credentials from a clean machine, and rebuild from a trusted source. Future installs: npm config set ignore-scripts true, pin exact versions, and never npm-install on the machine that holds production secrets.
This verdict reflects your self-reported checklist answers. It is not a forensic finding: a CLEAN result does not certify your install chain, and an INVESTIGATE result does not prove compromise. Automated help: npm-lifecycle-hook-auditor (Python, stdlib only).
The first infected install. In the October 2026 wave, a published npm package shipped with a Shai-Hulud worm payload in its preinstall hook — every developer who installed it became a carrier, leaking credentials to the attackers. Finding your patient zero means tracing install timelines against the known malicious versions, then rotating every secret that machine ever touched.
Shai-Hulud is a self-replicating npm supply-chain worm. It compromises packages by adding malicious lifecycle hooks (preinstall/install/postinstall scripts) so the payload runs at install time — before any application code executes. The October 2026 tensorlake incident (version 0.5.144) used a preinstall hook running node lib/setup.mjs, which downloaded the Bun runtime and executed an obfuscated ~856 KB payload harvesting developer credentials.
No. The same release run also published six tensorlake-native-*@0.5.144 binary packages, and an earlier August 2026 campaign using the same worm family reportedly affected at least 444 packages across 1,381 versions. Only packages named in verified advisories should be treated as confirmed — this page names only those.
Start with your lockfiles: grep for the poisoned version string (e.g. tensorlake@0.5.144). Then enumerate lifecycle hooks in your dependency tree, grep installed files for the worm's marker (WORMTAG) and known loader filenames (setup.mjs, Math_Symbol.js), flag Bun-runtime invocation, and review commits and CI logs around the incident window. The 8-step checklist above is a guided self-audit — not a forensic verdict.
Treat the machine as fully compromised. The critical order from security researchers: kill the worm's token-monitor process FIRST, then rotate credentials — revoking a stolen GitHub token while the monitor still runs has been documented to trigger a home-directory wipe. Rotate npm, GitHub, cloud, Kubernetes, Vault and SSH credentials from a clean machine, and rebuild from a trusted source.