Compromised Tensorlake npm Release Puts Agent Sandbox Installs Ahead of the Sandbox

Socket Research reported on October 8, 2026, that tensorlake version 0.5.144 on npm was compromised in a ChainDrop / Shai-Hulud supply-chain attack. The package is the TypeScript SDK for Tensorlake’s serverless sandboxes, which teams use to run untrusted, LLM-generated code with checkpointing and suspend/resume. Socket says the malicious release was published at 01:12 UTC and flagged about eleven minutes later. The package sees on the order of 12,000 weekly downloads and the tensorlakeai/tensorlake GitHub project has more than 1,000 stars; those figures describe overall usage, not confirmed infections of the bad build.

The uncomfortable part for agent stacks is where the code runs. Sandboxes are meant to contain model-written programs. A compromised SDK, Socket notes, executes on the machine that installs it—developer laptops, application servers, CI runners—before any generated code reaches an isolated environment. Teams that carefully cage agent output can still expose deployment credentials and cloud tokens at install time.

What the bad release did, at a high level

Socket describes an install-time loader that launches an obfuscated credential-stealing and self-propagating payload. Developers do not need to import the SDK or start an agent for that path to run when dependency lifecycle scripts are permitted. The payload’s collection targets, per Socket’s assessment, span npm and GitHub tokens, cloud credentials and secrets stores, local Vault and Kubernetes material, SSH keys, environment files, and configuration associated with common AI development tools. Persistence and remote code execution support extend the risk beyond a single stolen API key.

Propagation follows the pattern documented in earlier ChainDrop / Shai-Hulud waves against other npm packages: stolen publishing credentials are used to republish compromised versions, and strings suggest planted GitHub Actions workflows. The command-and-control endpoint is not hardcoded; Socket says the payload resolves it through an Ethereum contract across many public RPC endpoints, with a GitHub fallback, matching the resolver design seen in prior waves.

A separate “hostage token” monitor is the detail operators need before they revoke anything. Socket reports a persistence mechanism that watches whether a stolen GitHub token remains valid. If that token is revoked while the monitor is still running, an attacker-supplied handler can wipe the user’s home directory. The literal threat string tied to revocation has appeared in earlier Shai-Hulud campaigns. Endor Labs and Sonatype published matching accounts of the same compromised version the same day.

Affected version and clean-path guidance

The malicious npm release identified across the vendor write-ups is tensorlake@0.5.144. The prior release, 0.5.143, published October 6, is the last known good pin called out in several advisories. By the afternoon of October 8 UTC, the npm registry’s latest tag pointed at 0.5.145. Teams should treat any post-incident release as unverified until Tensorlake or independent scanners confirm it is clean; do not assume the newest tag is safe solely because the number moved.

Mitigations, framed without exploit detail:

• Search manifests, lockfiles, build logs and deployed artifacts for 0.5.144 and block further installs of that version.
• Treat any host where install scripts for that version ran as compromised; removing the dependency alone does not remove persistence.
• Isolate affected hosts and remove the token-monitor persistence before revoking GitHub or other tokens, following Socket’s platform-specific cleanup order.
• Only after persistence is gone, rotate exposed credentials and audit connected accounts for unauthorized package publishes and repository changes.
• Rebuild from trusted sources and restore secrets only onto clean hosts.

Install Hooks Run Before Any Sandbox Exists

Supply-chain worms are not new to npm. What sets this release apart is the target class: tooling that sits in the agent control plane and is installed on privileged hosts. Isolated sandboxes do not protect the workstation that provisions them. Install hooks inherit the privileges of the installing process, which often include cloud roles, registry tokens and CI secrets that an agent sandbox would never see.

The vendor reports are operator alerts, not how-tos. For teams running Tensorlake or any similar agent infrastructure SDK, the immediate work is inventory and host triage, not a code change inside the sandbox product. Pin away from 0.5.144, assume install-time compromise where that version ran, and sequence persistence removal ahead of token revocation so a dead-man switch does not punish the cleanup. Rotate credentials from a clean machine once persistence is gone, and give CI runners and build caches that pulled 0.5.144 the same review as developer laptops.