Tensorlake AI agent SDK on npm hijacked to spread the ChainDrop credential-stealing worm
What happened
Version 0.5.144 of the tensorlake npm SDK, used to build AI agent applications and sandboxes, was published with a malicious install-time payload linked to the ChainDrop / Shai-Hulud worm. It targets developer and cloud credentials and AI coding tool configuration files, and plants Claude Code settings to persist in projects.
Socket flagged the release about 11 minutes after it was published on 8 October 2026. Its structure matches the August ChainDrop / Shai-Hulud compromises of keyv and cacheable. Targeted data includes npm, GitHub and cloud credentials and configuration and MCP files for Claude, Cursor, Kiro, Windsurf and Zed; the worm can also republish packages under a victim's npm identity. The package has about 12,000 weekly downloads overall; installs of the bad version are not counted.
How it happened
Supply chain and access: Poisoned package. A malicious or tampered AI package, extension, plugin or MCP server was published and installed by users.
The software involved works with many AI models, so no single model maker was involved. The product was tensorlake npm SDK, which is open source, a type of AI building block.
Impact
Data was exposed. Data involved: credentials. There is no evidence that anyone actually accessed the data.
Severity is rated Low, calculated from how far the incident reached and how sensitive the data was.
Was the AI at fault?
No. The failure was in the systems, settings or people around the AI, not in the model's behaviour.
Status and timeline
Confirmed by the affected organization, the AI vendor, a regulator or a named security research firm.
It happened or began on 8 Oct 2026. It became public on 8 Oct 2026, 0 days later.