Summary
- Socket identified the malicious code in Tensorlake SDK version 0.5.144, published on 8 October 2026 at 01:12:07 UTC. The security firm flagged the release at 01:23:10 UTC
- The release was associated with the ChainDrop and Shai-Hulud family of software supply chain attacks, according to Socket. Its researchers identified credential collectio
- Tensorlake provides isolated sandboxes for applications that run untrusted code generated by large language models. Developers use its TypeScript SDK to create and contro
A compromised release of the Tensorlake software development kit installed credential-stealing malware through an npm lifecycle script, exposing systems used to develop and run AI agents before their isolated execution environments were launched.
Socket identified the malicious code in Tensorlake SDK version 0.5.144, published on 8 October 2026 at 01:12:07 UTC. The security firm flagged the release at 01:23:10 UTC, approximately 11 minutes after it entered the registry.
The release was associated with the ChainDrop and Shai-Hulud family of software supply chain attacks, according to Socket. Its researchers identified credential collection, exfiltration, persistence and remote execution functionality within the malicious package.
Tensorlake provides isolated sandboxes for applications that run untrusted code generated by large language models. Developers use its TypeScript SDK to create and control those environments, but installing the SDK takes place in the developer or build environment outside the sandbox.
That distinction explains why an installation-time compromise can bypass the assumptions behind safe agent execution. An npm preinstall hook may run before the application imports the library or invokes a model, provided the package manager is configured to permit lifecycle scripts.
The malicious package declared a preinstall operation that loaded code from its distribution files. Because this operation executes with the privileges available to the installation process, the sandbox intended for later generated code does not automatically constrain the malicious dependency.
Build systems often have access to publishing tokens, source repositories, cloud service credentials and other secrets needed to deliver an application. Their access can make a compromised installation step consequential even if developers never execute the newly installed application.
Socket reported that the payload attempted to collect npm and GitHub credentials as well as other secrets, including material associated with cloud and secrets-management environments. The research also described mechanisms for persistence and subsequent execution of supplied commands.
Publishing credentials are particularly sensitive because they can let an attacker alter releases distributed to downstream developers. A single compromised dependency may therefore create further opportunities for malicious updates, although the extent of propagation arising from this particular incident has not been publicly established.
The researchers estimated that the legitimate Tensorlake package received about 12,000 downloads in an ordinary week. That is an indicator of package use, not a count of installations of the malicious version, successful compromises or organisations affected.
Even a short-lived package release can execute on machines that install it before a security system blocks or removes the affected version. Removing a release from a package registry prevents new downloads through that route, but cannot revoke credentials already obtained from earlier installations.
The case also illustrates the difference between reviewing the code an AI agent generates and assessing the components used to operate the agent. The isolated runtime, SDK, package manager and deployment pipeline occupy separate trust boundaries, with potentially different permissions and telemetry.
AI services increasingly depend on general-purpose developer ecosystems rather than bespoke application components. The incident arose through a familiar package installation mechanism, so its relevance extends to conventional application security and the way organisations restrict access to secrets within build processes.
A registry-side alert can narrow the time between malicious publication and discovery, but does not determine whether every downstream installation was prevented. The difference matters because automated builds can fetch new dependency versions rapidly, and organisations may not retain a complete record of which lifecycle scripts ran in each environment.
Investigations also need to distinguish machines on which the package was merely downloaded from those on which package installation was completed with scripts enabled. That distinction affects the assessment of credential exposure, especially in short-lived continuous integration environments where the affected machine may no longer exist by the time the incident is recognised.
Socket published indicators and technical findings for investigators examining installations of version 0.5.144. The number of systems on which the payload executed and the extent of any subsequent credential abuse remain unknown publicly.
