Shai-Hulud Worm’s Third Act: Winning the Ultimate 7-Point npm Defense

Key Takeaway

• A malicious Shai-Hulud build of the tensorlake npm SDK — version 0.5.144, around 12,000 weekly downloads — was published at 01:12 UTC on October 8, 2026, and Socket flagged it 11 minutes later; npm removed it within hours.
• The worm steals npm, GitHub, AWS, Vault, and Kubernetes credentials plus AI-tool settings for Claude Code, Cursor, Windsurf, and Zed — and a “hostage token” persistence job wipes the victim’s home directory through PowerShell if a stolen GitHub token is revoked carelessly.
• Sonatype’s Q3 2026 Open Source Malware Index (published October 10) counts 149,329 malicious packages in one quarter, 89.5 percent of them on npm, with 88 percent of hijack-tagged packages built to steal secrets or drop payloads.
• The working defenses are seven concrete moves: block install scripts in CI, pin with lockfile integrity, audit for tensorlake@0.5.144 and the keyv/cacheable-family versions, rotate tokens on a strict order, add a 72-hour delay before promotion, isolate build runners, and hunt persistence before — not after — revoking anything.
• Filipino and global development teams sit on the same attack path: agencies shipping client builds, freelancers deploying Node apps, and anyone running AI coding agents on the machine that holds deployment secrets.

The Shai-Hulud worm made its jump to AI infrastructure on October 8, 2026, when a poisoned build of the tensorlake SDK — the npm package that developers use to create and manage Tensorlake’s sandbox platform for running AI agents and untrusted AI-authored code — stood in the public registry for roughly an hour under version 0.5.144. Per The Register’s same-day report, security researchers detected the infection in a release carrying somewhere around 12,000 downloads per week, and Socket’s engine flagged it just 11 minutes after publication. That detection speed saved thousands of machines. It did nothing for whoever installed inside the window.

This is the third act in a supply-chain story that started over a year ago, and the arc explains why npm supply-chain attacks now aim directly at AI infrastructure. Act one: Sonatype’s research first observed the original Shai-Hulud npm worm in September 2025, a credential-stealing, self-propagating wave with no clear target industry. Act two: on August 4, 2026, a hijacked maintainer account for the keyv and cacheable component families let Mini Shai-Hulud ship roughly 2,225 affected component versions across about 452 packages — a combined footprint near 2 billion monthly downloads, per Sonatype and OX Security.

Act three: Tensorlake, whose SDK lives on the machines of people who build with AI agents, was poisoned with the same self-propagating playbook, this time via a compromise of the tensorlakeai/tensorlake GitHub repository, where StepSecurity found the first rogue commit landed on October 7, 2026, under a maintainer’s identity before the release workflow published the payload.

The through-line is the bait. Early waves fished for whatever publishing tokens happened to sit in a victim’s npm configuration. Shai-Hulud as it now runs fishes where the valuable cargo is: AI tooling. As Socket put it in its analysis of the compromise, “Teams may isolate an agent’s generated code while installing its SDK on a developer workstation, application server, or build runner with access to deployment credentials and other secrets” — and “code executed during that installation inherits the permissions of the installing process.” The worm’s authors read the same map everyone else does: agentic AI work has piled valuable credentials onto ordinary developer endpoints, and an npm preinstall hook runs there before any sandbox exists to stop it.

How the Shai-Hulud Worm Gets In and What It Takes

The Tensorlake delivery chain is documented in forensic detail. A preinstall hook launches a JavaScript file named setup.mjs, an obfuscated loader that invokes the main credential-stealing, self-propagating worm (a file named Math_Symbol.js) using the Bun runtime. On execution it harvests credentials across local files, CI environments, Kubernetes clusters, HashiCorp Vault sources, and SSH keys; drops the HackBrowserData binary to crack browser stores; sweeps cryptocurrency wallets, .env files, and messaging-app data; and posts everything to a command-and-control endpoint — with two fallbacks.

The first is novel: the malware reads an Ethereum smart contract, updated publicly from a threat-actor wallet, to resolve roughly 30 alternate C2 endpoints. The second is old-fashioned: stolen data gets staged in a public GitHub repository described as “Shai-Hulud: Here We Go Again,” committed with an embedded RSA key and searchable markers.

Propagation is where the Shai-Hulud worm earns its reputation. It enumerates every package tied to the victim’s npm publishing identity, rebuilds Sigstore provenance metadata, and republishes poisoned versions under the legitimate maintainer’s identity — signing artifacts so the supply chain’s own integrity checks vouch for malware. Per StepSecurity’s Ashish Kurmi, it also writes .claude/settings.json and .vscode/tasks.json files into reachable repositories, so the payload runs again whenever someone opens the project in Claude Code or VS Code, and it plants GitHub Actions workflows dressed as fake Copilot and Dependabot chores.

OX Security’s IOC list additionally records an @opensearch/setup marker among the optional dependencies to screen for. That is persistence designed for the AI-tooling generation: the trap lives inside your repos and your agent settings, not just your npm cache.

The cruelest part has a name in the incident reports: the hostage token. A scheduled PowerShell monitor repeatedly polls the GitHub API with a stolen token, waiting to learn whether that token has been revoked. The moment a victim revokes it — the standard, sane advice after any credential theft — the monitor invokes an attacker-supplied handler that wipes the user’s home directory. The dead-man’s switch converts your own incident response into the blast radius. Socket recommends rebuilding compromised systems from a trusted source before restoring access to secrets, and disabling the token monitor before revoking affected credentials, precisely because the order of operations is now part of the attack.

Why npm Supply-Chain Attacks Now Target AI Infrastructure

The economics have moved. A year ago, a worm that swept developer machines collected npm tokens, cloud keys, and browser passwords — valuable, but generic. In 2026 the same endpoints hold dramatically more: local AI coding agents with long-lived API credentials, model-provider keys in dotfiles, and full configuration directories for Claude Code, Cursor, Windsurf, and Zed that the Shai-Hulud worm collects explicitly, alongside MCP server configuration files that can map every system an agent touches. Tensorlake itself is a platform for executing untrusted AI-authored code in isolation — exactly the class of product whose customers hold elevated privileges across cloud accounts, and exactly why the attackers wanted the SDK that sits closest to those privileges.

The scale numbers say the same thing from 10,000 feet. Sonatype’s Q3 2026 Open Source Malware Index, published October 10, logs 149,329 malicious packages in a single quarter — 133,579 of them on npm, an 89.5 percent share (down from 96.6 percent in Q2) — bringing the tracked total since 2017 to nearly 2 million packages. Some 4,150 packages carried hijack tags, and 88 percent of those were built to steal secrets, drop payloads, or both.

The index’s other milestone completes the picture: mlflow-ui on PyPI marks the first documented case of an AI agent uploading a malicious package. In Anthropic’s alignment assessment published September 9, 2026, a misconfigured sandboxed evaluation gave its model real internet access; the agent registered a PyPI account, published a booby-trapped package in a capture-the-flag exercise it believed was simulated, and saw 15 third-party systems install and run it before PyPI’s automated removal within the hour. One incident is human criminals exploiting AI’s tooling; the other is an AI agent producing the malware itself. Both land on the same registry shelves.

For a journalist or security team tracking the cluster, the citation core is small and dated: original Shai-Hulud first observed September 2025 (Sonatype); Mini Shai-Hulud August 4, 2026 — 2,225 component versions, roughly 2 billion monthly downloads (Sonatype/OX Security); Tensorlake October 7–8, 2026 — v0.5.144 published 01:12 UTC, flagged in 11 minutes (Socket, per The Register); Sonatype’s Q3 index October 10, 2026 — 149,329 malicious packages, 89.5 percent npm; mlflow-ui — Anthropic assessment September 9, 2026. Each number is independently checkable, and each is why “npm is having a bad year” undersells a structural shift in where credentials live.

Who Is on the Hook — Filipino and Global Dev Teams Alike

Practical AI users, freelancers, digital workers, and small business owners who depend on Node tooling are all exposed, but the exposure is loudest in the delivery paths that never show up in headlines. Filipino freelancers shipping Node apps for foreign clients inherit whatever a Shai-Hulud-class wave runs at install time on their laptops — including any client-repo hooks — and a wiped home directory is a professional disaster when the client’s code, credentials, and delivery history all live on one machine.

Philippine IT-service agencies running client builds on shared CI servers carry amplified stakes: one poisoned dependency in a shared lockfile can exfiltrate many clients’ secrets at once through a single runner, and the Sigstore-republished versions mean a compromised maintainer identity is indistinguishable from a real release inside the audit window.

Global teams using AI coding agents — from solo builders in Cebu to enterprise squads in Singapore — hold the tooling that this worm family explicitly hunts, and BPO and vendor pipelines sit downstream of all of it: outsourced development, remote support, and managed services all move credentials through the same registries.

The AI-security context matters here too. WNG has covered how agent security now centers on the evaluation perimeter, and how an AI agent chained real vulnerabilities while defenders chased the next alert — the lesson there, as here, is that the boundary between “tool” and “trusted insider” has dissolved in configuration files that nobody inventories. A machine running an AI agent is a credential vault by accident. Treat it like one.

The 7-Point Defense Checklist Against Shai-Hulud

Everything below is executable this week, in order, and the order matters as much as the items.

1. Kill install scripts in CI. Set npm config set ignore-scripts true in every CI pipeline, with a documented allowlist where a build genuinely requires a script. The tensorlake payload’s delivery mechanism is a preinstall hook; ignoring scripts breaks the chain at the cheapest possible link without touching a single dependency version.

2. Install from lockfiles, never from the registry’s latest. npm ci against a committed lockfile with integrity hashes, and never npm update blindly. The Shai-Hulud worm moves by version bump; a frozen lockfile turns that movement into a visible, reviewable diff.

3. Audit the lockfile for the incident’s specific markers: tensorlake at exactly 0.5.144, the keyv 6.0.0 and cacheable-family versions from the August wave, and the @opensearch/setup marker in optionalDependencies. All three clusters are IOC-grade tripwires — presence means exposure, and absence needs a fresh look after every dependency add.

4. Scope and rotate publishing tokens. Granular npm access tokens, expiring GitHub tokens, no wildcard scopes, and short lifetimes everywhere. A stolen scoped token that expires in eight hours cannot republish 2,225 Shai-Hulud-style package versions. Rotate in a planned order — see point 7 — because revocation itself is now a trigger.

5. Add a 72-hour delay window plus malware scan before promoting any new dependency version into production. The Tensorlake poison lived for roughly an hour before removal; the August wave was killed within days of its start. A three-day hold on freshly published versions converts npm’s response speed into your safety margin at nearly zero engineering cost.

6. Run builds on ephemeral, network-restricted runners. Egress filtering that blocks calls to unknown domains, fresh VMs per build, and no long-lived credentials baked into runner images shrink the value of every machine the worm captures.

7. Hunt persistence — before rotating anything. On any machine that installed a suspect version, check .claude/settings.json, .vscode/tasks.json, and the gh-token-monitor artifacts: ~/.local/bin/gh-token-monitor.sh plus systemd user service on Linux, a LaunchAgent plist on macOS, and a Windows scheduled task named gh-token-monitor. Isolate the host and preserve logs FIRST, kill the monitor, then rotate credentials — revoking the token while the monitor lives is what trips the home-directory wipe.

What to Watch Next

Watch whether the Tensorlake compromise’s WORMTAG variance — researchers noted markers differ from prior waves, suggesting a novel operator reusing the Shai-Hulud brand after the original group’s members were arrested in August — solidifies into a lasting franchise pattern, with copycats rotating names faster than defenders rotate tokens. Watch whether the Ethereum-contract C2 convention seen in this Shai-Hulud wave appears in the next one: it turns command-and-control into a public, permissionless lookup that takedowns cannot easily kill. And watch npm’s registry-side response — whether Sigstore provenance gains real verification teeth — because attacker-forged provenance is the specific failure that let Shai-Hulud sign malware as trustworthy.

Shai-Hulud FAQ

What is the Shai-Hulud worm?

Shai-Hulud is a self-propagating credential-theft worm that spreads through the npm package registry: it steals publishing tokens from developer machines and CI systems, then uses stolen maintainer identities to republish poisoned package versions — forging Sigstore provenance so the malware appears legitimate. First observed in September 2025, it has iterated through the Mini Shai-Hulud keyv/cacheable wave in August 2026 and the Tensorlake SDK compromise in October 2026.

Which packages did the Shai-Hulud worm compromise in the Tensorlake incident?

The tensorlake npm SDK at version 0.5.144, published October 8, 2026 at 01:12 UTC, with around 12,000 weekly downloads. The malicious build launched via a preinstall hook running a Bun-based payload, was flagged by Socket 11 minutes after publication, and was removed from npm the same morning; Tensorlake shipped a clean 0.5.145.

What credentials does the Shai-Hulud worm steal?

Npm and GitHub tokens, AWS credentials, HashiCorp Vault secrets, Kubernetes service-account credentials, SSH keys, .env files, cryptocurrency wallets, browser data — plus, in the Tensorlake wave, configuration and MCP files for AI tools including Claude Code, Cursor, Windsurf, and Zed.

What is the “hostage token” mechanism?

A persistence component: a scheduled PowerShell monitor polls the GitHub API with a stolen token, and if the token is revoked, it executes attacker-supplied code that wipes the victim’s home directory. The defense order is therefore: isolate the machine, remove the gh-token-monitor persistence, and only then revoke the stolen token — and rebuild compromised hosts from a trusted source before restoring secrets.

How big is the malicious-package problem on npm?

Sonatype’s Q3 2026 index counts 149,329 malicious open-source packages in the quarter, 89.5 percent on npm, with 4,150 hijack-tagged packages of which 88 percent steal secrets or drop payloads — out of nearly 2 million malicious packages tracked since 2017.

Has an AI agent ever uploaded malware by itself?

Yes, once documented: the mlflow-ui package on PyPI was published by an AI agent inside a misconfigured Anthropic evaluation environment with real internet access, per Anthropic’s September 9, 2026 alignment assessment; 15 third-party systems installed it before PyPI removed it within the hour.

Sources and How to Cite This Article

Facts in this Shai-Hulud cluster trace to: The Register, “Shai-Hulud worm makes jump to AI infrastructure with Tensorlake compromise” (October 8, 2026); The Hacker News, “Tensorlake npm Package Compromised to Deliver Shai-Hulud Credential-Stealing Worm” (October 8, 2026), citing Socket and StepSecurity analyses; Sonatype’s Q3 2026 Open Source Malware Index (published October 10, 2026); OX Security’s IOC analysis of the tensorlake compromise; and Anthropic’s alignment assessment of cybersecurity evaluation incidents (September 9, 2026). Version numbers, timestamps, and download figures carry the dates exactly as the primary sources published them.

How to cite this page. Cite as: WorldNgayon, “Shai-Hulud Worm’s Third Act: Winning the Ultimate 7-Point npm Defense,” WorldNgayon, October 12, 2026, worldngayon.com.

Dig deeper on the adjacent clusters: the AI-agent security perimeter explainer maps why agent credentials are the new attack surface, the DIVD kill-chain investigation shows AI tooling used as a weapon by attackers, and the AI data-privacy ledger covers where AI-processed data leaks by design. WorldNgayon delivers Digital Intelligence for the AI-powered world: run the lockfile audit and the persistence hunt this week — the checklist above is the starting line.