A valid provenance attestation carried the Shai-Hulud worm through the package's own release workflow, and its dead-man switch punishes a fast token revoke.
At 01:12 UTC on October 8, tensorlake 0.5.144 landed on npm. Socket flagged it 11 minutes later. The package, an SDK for Tensorlake's AI agent sandboxes with about 12,000 weekly downloads, carried preinstall: node lib/setup.mjs, so the payload ran during install without an import or a single line of application code.
The payload starts through Bun and harvests npm and GitHub tokens, AWS instance and container credentials, Vault tokens, Kubernetes service accounts, SSH keys, .env files, wallets, and the MCP configuration for Claude Code, Cursor, Kiro, Windsurf, and Zed. It also acts as a worm, republishing packages tied to the victim's publishing identity with generated Sigstore provenance.
The persistence is the trap. The malware installs a token monitor as a scheduled task and watches the stolen GitHub token. If you revoke that token while the monitor is active, it can wipe the machine's home directory. Remove the monitor first: systemctl --user disable --now gh-token-monitor.service on Linux, unload the LaunchAgent on macOS, delete the ONLOGON task on Windows. Then isolate the host and rotate every credential from another machine.
GitHub's advisory treats any machine that installed 0.5.144 as fully compromised. npm pulled the release. Version 0.5.145 has no install scripts, but verify the artifact rather than trusting a version range.
CVE-2026-85625 covers sift through 17.1.3 with no patched release: a prototype-pollution path plus default `$where` compilation turns a benign `sift({})` call into arbitrary code execution.
3 sources
Coming in July 2026, npm v12 disables automatic install scripts, git dependencies, and remote URL resolution by default. Every frontend team needs an allowlist before the upgrade lands.
1 source
The threat group behind the Miasma worm has expanded its attack surface to VS Code extensions, using them as a vector to compromise GitHub accounts and inject malicious code into open source projects.
2 sources