Am I affected by Tensorlake npm Package Compromised: A Worm With a Hostage Token That Wipes Your Machine…? What should I do?
The malicious release was built from the project's own main branch and published with an npm provenance attestation.
Affected: tensorlake@0.5.144. Fixed in: no fix reported yet. What should you check, and what should you do about it?
Full incident page with sources: https://agentarmorhq.com/incidents/2026/10/news-stepsecurity-stepsecurity-cdedf0adce741c46-tensorlake-npm-package (opens external site)
1 answer
Am I affected? Affected: tensorlake@0.5.144. Fixed in: no fix reported yet.
- Check your version: run
npm ls tensorlake. Versions 0.5.144 of tensorlake are affected.
What to do now
- Remove the package if it is installed: run
npm uninstall tensorlake. - Pin tensorlake to 0.5.143 in the meantime.
- Remove the token monitor first (steps below), then rotate your credentials.
- Setting ignore-scripts=true in .npmrc stops install hooks like this one.
- If you can't be sure the machine is clean, wipe it and start fresh.
General practice, not from the source: if the affected software could read tokens or credentials, rotate them after upgrading; pin versions and review changes before updating tools your agents run.
Sources
- StepSecurity: https://www.stepsecurity.io/blog/tensorlake-npm-compromised-hostage-token-worm (opens external site)
Full incident page: https://agentarmorhq.com/incidents/2026/10/news-stepsecurity-stepsecurity-cdedf0adce741c46-tensorlake-npm-package (opens external site)
Did this work for you?- Check your version: run