Am I affected by TensorLake npm SDK Compromised in ChainDrop Shai-Hulud Credential-Stealing Attack? What should I do?

Question

Version 0.5.144 contains obfuscated malware that harvests credentials, exfiltrates secrets, establishes persistence, and executes remotely supplied code.

Affected: tensorlake 0.5.144. Fixed in: no fix reported yet. What should you check, and what should you do about it?

Full incident page with sources: https://agentarmorhq.com/incidents/2026/10/news-socket-socket-7765f6bc5cd22127-tensorlake-npm-sdk

AgentArmor team · Accepted Answer

**Am I affected?**
Affected: tensorlake 0.5.144. Fixed in: no fix reported yet.
- Check your version: run `npm ls tensorlake`. Versions 0.5.144 of tensorlake are affected.

**What to do now**
1. Remove the package if it is installed: run `npm uninstall tensorlake`.
2. Teams using Tensorlake should check dependency manifests, lockfiles, build logs, and deployed artifacts for tensorlake@0.5.144.
3. Block the affected version and prevent further installation.
4. Remove the token monitor before revoking any tokens.
5. Only after the previous step revoke and replace exposed credentials.

General practice, not from the source: if the affected software could read tokens or credentials, rotate them after upgrading; pin versions and review changes before updating tools your agents run.

**Sources**
- Socket: https://socket.dev/blog/tensorlake-compromise?utm_medium=feed

Full incident page: https://agentarmorhq.com/incidents/2026/10/news-socket-socket-7765f6bc5cd22127-tensorlake-npm-sdk

Am I affected by TensorLake npm SDK Compromised in ChainDrop Shai-Hulud Credential-Stealing Attack? What should I do?

1 answer

Add your answer or comment