Tensorlake npm Worm Rewrote Your AI Agent Config Files

A compromised tensorlake npm release stole credentials and wrote .claude/settings.json into repos, turning the next reopen into reinfection.

On October 8, 2026, a malicious release of the tensorlake npm SDK, version 0.5.144, ran a preinstall hook that stole npm, GitHub, AWS, Vault, and Kubernetes credentials, SSH keys, and crypto wallet data from any machine that installed it. It also harvested configuration and MCP files for Claude, Cursor, Kiro, Windsurf, and Zed, then wrote new files into reachable repositories so the next person who opened that project in Claude Code or VS Code triggered the infection again.

That last part is the detail worth sitting with. Most coverage of supply chain attacks stops at "it stole your tokens, rotate them." This one planted its own foothold inside the exact files that tell an AI coding agent what to trust and what to run, which means the fix is not just rotating credentials, it is auditing files most teams have never once put through code review.

What actually happened

Tensorlake publishes a TypeScript SDK used to build agent infrastructure and sandboxes. According to Socket and StepSecurity, attackers pushed malicious commits to the main branch of the tensorlakeai/tensorlake repository on October 7, 2026, under a maintainer identity, and a release workflow published the tainted code to npm as version 0.5.144 the next day at 01:12:07 UTC. Socket says its automated scanning flagged the release about eleven minutes later. npm has since pulled the package from the registry, and both Endor Labs and StepSecurity recommend pinning to 0.5.143, the last version confirmed clean.

Sources: Socket: TensorLake npm SDK Compromised in ChainDrop Shai-Hulud Credential-Stealing Attack, StepSecurity: Tensorlake npm Compromised, Hostage Token Worm, The Hacker News: Tensorlake npm package compromised, Endor Labs: tensorlake npm package compromised by shai hulud

The manifest for the poisoned release added a preinstall entry, "preinstall": "node lib/setup.mjs", so the payload executes the moment npm install runs, before a developer ever imports the SDK or writes a line of code against it. That file is an obfuscated loader that uses the Bun runtime to launch a second obfuscated file, lib/Math_Symbol.js, which both Socket and The Hacker News identify as the actual credential-stealing and self-propagating payload. A preinstall hook is an ordinary, documented npm feature. The attack here is not a new mechanism, it is the oldest trick in npm supply chain attacks, pointed at a newer set of targets.

Sources: Socket: TensorLake npm SDK Compromised, The Hacker News: Tensorlake npm package compromised

The credential haul: broad and specific

• npm: .npmrc files, npm token API calls, and OIDC token exchange flows
• GitHub: personal access and OAuth tokens, checked for repository and workflow scopes before use
• AWS: credentials pulled from IMDS, ECS task metadata, Secrets Manager, and SSM Parameter Store
• HashiCorp Vault: local instances on 127.0.0.1:8200, including Kubernetes and AWS auth paths
• Kubernetes: service account tokens and kubeconfig files
• SSH private keys, .env files, cryptocurrency wallet data, and messaging app data

None of that list is unusual for a credential-stealing npm worm in 2026. What is new is the line item sitting next to it: configuration and MCP (Model Context Protocol) files belonging to Claude, Cursor, Kiro, Windsurf, and Zed, named specifically by The Hacker News as data the payload collects and exfiltrates. StepSecurity separately confirms the malware targets config for "Claude, Cursor and Windsurf." The exact file manifest the malware reads has not been fully published by any outlet, but the direction is clear: AI coding agent configuration is now a named target category, not an afterthought swept up in a generic file-grab.

Sources: The Hacker News: Tensorlake npm package compromised, StepSecurity: Tensorlake npm Compromised, Hostage Token Worm

The part everyone is missing: the reinfection loop

Credential theft gets fixed with rotation. This incident built a second, independent way back in, one that survives credential rotation entirely, by writing itself into the project instead of only reading from it. According to StepSecurity, once the malware holds a stolen GitHub token with repository access, it commits new files, specifically .claude/settings.json and .vscode/tasks.json, into every reachable repository, using a forged author identity of claude@users.noreply.github.com and the commit message "chore: update dependencies." The Hacker News reported the same mechanic, attributing it to StepSecurity's research: the malware writes those two files into repos it can reach so that it runs again when someone opens the project in Claude Code or VS Code.

Sources: StepSecurity: Tensorlake npm Compromised, Hostage Token Worm, The Hacker News: Tensorlake npm package compromised

Walk through why that works. A traditional incident response plan after a supply chain compromise looks like: wipe node_modules, rotate every token the malware could have touched, reinstall from a clean lockfile, move on. That plan assumes the infection lived entirely in the dependency tree. Here it does not. The malware used a stolen, still-valid GitHub token to push a commit directly into the repository itself, the part every teammate pulls, clones, and reopens. Someone can delete node_modules, rotate their npm token and their AWS keys, and still have a poisoned .claude/settings.json sitting in version control, authored under a commit message boring enough that nobody reviewing routine dependency bumps would stop to question it.

This is a description of how real malware behaves, reported by Socket and StepSecurity after independent analysis of the payload, not a how-to. The useful takeaway for a defender is narrow and specific: a settings file for an AI coding agent is not a quiet local preference anyone can safely ignore. It is a file that can tell the agent what commands to trust, what to execute automatically, and what hooks to run on open, which makes it executable in every sense that matters for security, even though it looks, to a human skimming a diff, like configuration.

Why .claude/settings.json and .vscode/tasks.json specifically

Both files share one property that made them useful to the attacker: each is a place where the corresponding tool reads instructions, not just preferences, on project open. VS Code's tasks.json can define tasks that run automatically; Claude Code's settings.json can define permissions and hooks for the session. Planting a payload there means the next legitimate, well-intentioned action available to a developer, opening their own project in their own editor, is the trigger. Nobody has to be tricked into running a suspicious script. They just have to do their job.

A second trap: do not revoke the token first

StepSecurity documented a separate persistence mechanism layered on top of the config-file foothold, and it inverts the usual incident-response instinct. The malware installs a background "hostage token" monitor, a systemd user service on Linux, a LaunchAgent on macOS, and a scheduled task on Windows, that polls the GitHub API with the stolen token roughly once a minute for up to 24 hours. If that token gets revoked and the API starts rejecting it, the monitor runs an attacker-supplied handler that deletes the user's home directory. The standard first move after any credential leak, revoke the token immediately, is the one move this specific malware is built to punish. StepSecurity's guidance is to find and remove the monitor service first, then rotate credentials, not the other way around.

Sources: StepSecurity: Tensorlake npm Compromised, Hostage Token Worm

The ChainDrop / Shai-Hulud connection

Socket titles its writeup "ChainDrop Shai-Hulud Credential-Stealing Attack" and ties the tensorlake installation hook and filenames directly to the ChainDrop/Shai-Hulud npm compromises first documented in August 2026, which hit packages including keyv and cacheable with a self-propagating, Bun-based worm. Socket also notes the tensorlake payload resolves its command-and-control endpoint through an Ethereum smart contract, a design it says matches the earlier keyv compromise, and that a hardcoded string tied to the home-directory-wipe warning, previously seen in earlier Shai-Hulud waves, reappears in this payload. The Hacker News reports the same "ChainDrop / Shai-Hulud" framing and dates ChainDrop's first documentation to early August 2026. Endor Labs, in its own writeup of the same incident, describes it only as a Shai-Hulud variant and does not use the ChainDrop name, which is a naming difference between outlets rather than a contradiction of the underlying campaign link.

Sources: Socket: TensorLake npm SDK Compromised in ChainDrop Shai-Hulud Credential-Stealing Attack, The Hacker News: Tensorlake npm package compromised, Endor Labs: tensorlake npm package compromised by shai hulud

The worm also propagates sideways once it has a usable publishing credential: Socket and The Hacker News both report that it enumerates other npm packages tied to the victim's own publishing identity, generates a valid Sigstore provenance attestation, and republishes a compromised version under that identity, which is how a single stolen developer token can turn into a second and third poisoned package. A valid provenance attestation on a release only proves where the build pipeline says the code came from, not that the code itself is safe, since in this case the malicious commits were already on the trusted branch before the trusted pipeline built and signed the release.

Sources: Socket: TensorLake npm SDK Compromised, The Hacker News: Tensorlake npm package compromised

The governance gap this exposes

Most engineering orgs have a review process for application code and a separate, much looser standard for anything that looks like local tooling configuration. A pull request touching src/ gets eyes on it. A pull request that only touches .claude/settings.json, .vscode/tasks.json, or an MCP config file often does not, because those files read as personal editor preferences, the same category as a .gitignore tweak or an EditorConfig change. This incident is a direct demonstration of why that double standard is a liability: an AI coding agent's settings file can define what it is permitted to run, what it trusts without asking, and what happens automatically when the project opens. That is not a preference. That is an executable, trust-bearing artifact, and it belongs in the same review lane as a CI pipeline definition, not the same lane as a line-ending setting.

The same blind spot shows up in a different form in how self-replicating prompts spread through agent memory files, which an EPFL and Anthropic study described in August 2026: a file like CLAUDE.md or SOUL.md is read by an agent as instructions, not prose, and a team that treats it as harmless documentation misses exactly the risk this tensorlake incident weaponized on purpose. Two different attack paths, one shared root cause: agent-facing files that look inert to a human reviewer and are not inert to the agent reading them.

This is also a different failure mode than the npm package-flooding incident where OpenAI-linked agents published over 2,000 malicious RubyGems packages earlier in 2026. That case was an agent itself behaving badly at publish time. This one is a human supply chain compromise that specifically goes after the files an agent will later read as authoritative. Both point at the same gap: the artifacts that configure or steer an AI coding tool need the same scrutiny as the code that tool touches, not less.

Where TLM Forge fits

This is close to the problem TLM Forge is built around, without overstating it. How it works: a spec audit runs before an agent generates code, independent diff review checks every change against its own plan rather than trusting the author's description of it, and a red-team pass asks adversarial questions of the diff instead of pattern-matching against a fixed rule list. None of those three steps care whether the changed file is named index.ts or .claude/settings.json. A commit that adds a new preinstall-triggered script, or a commit that silently rewrites an agent's settings file under an innocuous message, is exactly the kind of change an independent review layer is positioned to flag, specifically because it treats every file in the diff as in scope, not just the ones a human reviewer's habits usually look at. The convergence gate then means that finding has to resolve to zero before the merge goes through, regardless of how routine the commit message makes the change look.