# tensorlake-npm-sdk-0-5-144-compromised-by-a-shai-hulud-chaindrop-worm: Tensorlake npm SDK 0.5.144 Compromised by a Shai-Hulud/ChainDrop Worm That Steals Cloud, CI and Claude/Cursor/Windsurf MCP Configs

> Tensorlake npm SDK 0.5.144 Compromised by a Shai-Hulud/ChainDrop Worm That Steals Cloud, CI and Claude/Cursor/Windsurf MCP Configs is a critical-severity supply chain compromise issue in tensorlake, a MCP server. Affected: =0.5.144. It has been exploited in the wild.

- **Canonical URL:** https://catalog.anomity.ai/vuln/tensorlake-npm-sdk-0-5-144-compromised-by-a-shai-hulud-chaindrop-worm
- **Aliases:** ti-132
- **Severity:** critical
- **Attack type:** Supply chain compromise, Credential theft, Malware
- **Component:** tensorlake (MCP server)
- **Package:** tensorlake (npm)
- **Catalog entry:** https://catalog.anomity.ai/agent/cursor
- **Exploited in the wild:** yes
- **Published:** 2026-10-08
- **Last verified:** 2026-11-01
- **JSON:** https://catalog.anomity.ai/api/entries/vuln/tensorlake-npm-sdk-0-5-144-compromised-by-a-shai-hulud-chaindrop-worm

## Summary

Socket and Endor Labs reported on 8 October 2026 that tensorlake@0.5.144, the TypeScript SDK for the Tensorlake AI sandbox platform, was published at 01:12:07 UTC with a malicious preinstall hook: `node lib/setup.mjs`, an obfuscated loader that starts the payload lib/Math_Symbol.js under Bun at install time, so no import of the SDK is needed. Socket flagged it about 11 minutes after publication. The payload harvests npm, GitHub, AWS, Vault, Kubernetes and SSH credentials, .env files and wallets, and, per Socket, the configuration and MCP files of Claude (.claude), Cursor (.cursor), Kiro, Windsurf and Zed. It spreads by republishing packages the victim can publish, with Sigstore provenance, plants GitHub Actions workflows disguised as Copilot or Dependabot, finds its C2 through an Ethereum contract, and installs a gh-token-monitor persistence task that can wipe the home directory if the stolen GitHub token is revoked. Endor Labs says the release went out through the project's normal GitHub Actions pipeline with valid build provenance after malicious commits to main, most likely from a compromised maintainer account. Six tensorlake-native-*@0.5.144 binary packages from the same run carried no payload. The malicious version has been removed from npm; 0.5.143 and earlier are clean.

## Affected versions

| Affected | Fixed in |
| --- | --- |
| =0.5.144 | no fixed version listed |

## Am I affected by this vulnerability?

You are affected if you run tensorlake =0.5.144.

## How do I fix it?

Block tensorlake@0.5.144, pin to 0.5.143, and purge lockfile entries and package caches that reference 0.5.144. Treat any host or CI runner where its install scripts ran as fully compromised and isolate it. Remove the gh-token-monitor persistence (systemd service, LaunchAgent plist or ONLOGON scheduled task) BEFORE revoking anything, because revoking the GitHub token while it runs can trigger a home-directory wipe. Then rotate npm, GitHub, cloud, Vault and SSH credentials plus any API keys held in Claude, Cursor, Kiro, Windsurf or Zed MCP configs on that host, audit for unexpected package publishes, repositories and workflows, and install with --ignore-scripts where practical.

## How do I find every machine running tensorlake?

Anomity inventories the AI agents, MCP servers, IDE extensions and skills on each developer device, so you can see which machines run tensorlake and which version, then enforce a policy on it.

## References

- article: https://www.socket.dev/blog/tensorlake-compromise

## Related vulnerabilities

- [symantec-the-aoki-infostealer-now-takes-claude-codex-cursor-copilot](https://catalog.anomity.ai/vuln/symantec-the-aoki-infostealer-now-takes-claude-codex-cursor-copilot) — high
- [agentjacking-public-sentry-dsn-hijacks-claude-code-cursor-codex-via-mcp](https://catalog.anomity.ai/vuln/agentjacking-public-sentry-dsn-hijacks-claude-code-cursor-codex-via-mcp) — high
- [trojanized-claude-code-extension-2-1-313-in-cursor-s-marketplace](https://catalog.anomity.ai/vuln/trojanized-claude-code-extension-2-1-313-in-cursor-s-marketplace) — critical
- [CVE-2025-54133](https://catalog.anomity.ai/vuln/cve-2025-54133) — high
- [shai-hulud-wave-c-payload-returns-after-111-days-including-feishu-docx](https://catalog.anomity.ai/vuln/shai-hulud-wave-c-payload-returns-after-111-days-including-feishu-docx) — critical
- [shai-hulud-reaches-the-official-mcp-registry-shipping-poisoned-claude](https://catalog.anomity.ai/vuln/shai-hulud-reaches-the-official-mcp-registry-shipping-poisoned-claude) — critical

---

Source: Anomity Security Database (https://catalog.anomity.ai/vuln). Detect affected AI tools on developer devices: https://anomity.ai/?utm_source=catalog&utm_medium=vuln-md&utm_campaign=tensorlake-npm-sdk-0-5-144-compromised-by-a-shai-hulud-chaindrop-worm