Shai-Hulud in 2026: ChainDrop, the Tensorlake Wave and the npm Supply Chain Checklist

At 01:12 UTC on 8 October 2026, Tensorlake's own release workflow published tensorlake 0.5.144 to npm with a valid provenance attestation and a credential-stealing worm inside. Socket flagged it at 01:23:10 UTC, Tensorlake's advisory says it was live until 02:54 UTC, and StepSecurity found a background service that deletes the user's home directory if the stolen GitHub token is revoked. It is the newest release in a lineage that began as Shai-Hulud in September 2025 and became ChainDrop on 4 August.

Quick answer. Treat any machine or CI runner that installed a listed version (tensorlake 0.5.144, keyv 6.0.0 or another package on the ChainDrop lists) with install scripts enabled as compromised. Remove the gh-token-monitor service before revoking any token, because revocation fires its handler (a home-directory wipe in the Tensorlake build), then rotate every reachable credential from a clean machine and rebuild. Close the paths these waves used: install scripts off (the npm v12 default), a release-age wait of at least the three hours CISA recommends, staged publishing with a human 2FA approval, and code review for .claude/ and .vscode/ files. Stingrai, a CREST-accredited penetration testing firm, tests CI/CD and supply chain paths in red team and assumed-breach engagements.

Every fact below comes from a primary source; statuses and counts are as of 13 October 2026. Our August analysis of the TanStack and Nx Console compromises explains how 84 malicious TanStack versions shipped with valid provenance; this post covers the rest of the family.

The lineage, wave by wave

The pace. StepSecurity counted 56 confirmed supply chain attacks in the 12 months to August 2026, 50 since February; our supply chain attack statistics cover the wider picture.

Who is behind it. StepSecurity attributed the TanStack wave to TeamPCP, the 12 May source release was signed "Love - TeamPCP" (Datadog), and on 26 August the Australian Federal Police, with the FBI and Western Australia Police, charged two men the FBI calls "allegedly members of the cybercriminal group TeamPCP." Those are allegations, and Socket notes that by mid-2026 "multiple operators were running Shai-Hulud style campaigns off the same open source code," so plan for more waves whatever happens in court.

ChainDrop: one maintainer account, hundreds of packages

On 4 August 2026, attackers took over the GitHub account of the maintainer behind keyv, cacheable, flat-cache and file-entry-cache (Expel), pushed poisoned commits and tags, and let the projects' own release workflows publish keyv 6.0.0 at 09:35 UTC and nine cacheable-family versions between 10:09 and 10:14 UTC (Socket). StepSecurity counted 11 full carriers in the maintainer's projects, then 433 more packages (2,201 versions) republished with credentials from at least a dozen unrelated organizations by 13:20 UTC. Most users got them transitively, via eslint to file-entry-cache to flat-cache to keyv (Socket).

The trackers disagree:

• StepSecurity: 444 packages and 2,212 versions, as of 18:10 UTC on 4 August.

• Datadog: 444 packages and 2,236 versions in its published list, last updated 6 August.

• Microsoft: "more than 400 packages across multiple unrelated publishers" (4 August).

• Cyber Security Agency of Singapore: "over 1,300 package versions" in advisory AD-2026-009 (6 August).

Check lockfiles against a full published list and mind jobs that skip the lockfile: StepSecurity found the payload calling out from CNCF Backstage end-to-end jobs that install "deliberately outside the repository's own lockfile," though those jobs held only the ephemeral GITHUB_TOKEN.

Tensorlake and the hostage token

Tensorlake's SDK manages sandboxes for untrusted, LLM-generated code, yet code run while it installs "inherits the permissions of the installing process" (Socket). StepSecurity says the first malicious commit landed on main at 01:20 UTC on 7 October under a maintainer's name, seven more followed without a pull request, and the release workflow published 0.5.144 at 01:12 UTC on 8 October. Tensorlake's advisory confirms "a compromised maintainer account"; its telemetry has "not seen any usage of this version since it was released."

• Persistence in editor and agent files. The malware writes .claude/settings.json and .vscode/tasks.json into repositories it can reach, "so it runs again when someone opens the project in Claude Code or VS Code," committing as claude@users.noreply.github.com (StepSecurity), the same trick StepSecurity documented in the April SAP wave.

• The hostage token. With a GitHub token in hand, it installs gh-token-monitor, which checks the token every 60 seconds for up to 24 hours and deletes the home directory if GitHub rejects it (StepSecurity), "regardless of where the revocation is done" (Socket). ChainDrop's monitor runs whatever handler the attacker supplies instead (StepSecurity; Socket), and the May TanStack payload tied a wipe threat to revoking an npm token it planted, described "IfYouRevokeThisTokenItWillWipeTheComputerOfTheOwner" (StepSecurity). Tensorlake, Socket, StepSecurity and Expel's May advisory say to remove the monitor before revoking; Expel's ChainDrop post, Microsoft and CSA Singapore say to rotate without mentioning it. Follow the monitor-first order whichever advisory you start from.

StepSecurity says this build skips CI; Tensorlake's advisory covers "any machine or CI system with install scripts enabled," the safer reading.

What the worm steals and how it spreads

What it takes. npm tokens from .npmrc and the registry's token and OIDC endpoints; GitHub tokens from the gh CLI, environment variables and, on GitHub Actions, the Runner.Worker memory that holds every secret injected into the job; AWS instance metadata, Secrets Manager and Parameter Store; Kubernetes secrets; Vault; SSH keys, .env files and AI tool configuration such as ~/.claude.json (StepSecurity; Datadog; Socket; Microsoft). See our post on non-human identity attacks.

How it spreads. Through publish rights. An npm write token that skips 2FA (bypass_2fa, per Datadog) or a CI job's OIDC publishing identity (Microsoft) lets it republish every package that identity can publish, with a preinstall hook and a self-generated Sigstore provenance bundle; a GitHub token lets it commit the .claude and .vscode hooks to reachable branches and, in ChainDrop, plant a workflow that copies repository secrets into a downloadable artifact (StepSecurity; Microsoft).

The Bun drop. Every wave since Shai-Hulud 2.0 runs its payload under the Bun runtime, downloading the official release from GitHub when it is absent (version 1.3.13 in the Bitwarden, SAP, TanStack and ChainDrop samples; StepSecurity, Datadog). Monitoring tuned to node child processes misses a bun process, and the download goes to github.com, so the signal is context: an install step fetching a runtime. An egress allow-list stops the chain at that first hop unless Bun is already installed (StepSecurity).

Exfiltration. Data leaves encrypted, to an endpoint ChainDrop and Tensorlake resolve from an Ethereum contract, so there is no fixed domain to sinkhole (StepSecurity; Socket).

Why provenance did not stop it

Provenance worked as designed in each case, which is the problem. StepSecurity's ChainDrop analysis puts it in one line: "Provenance proves which commit was built. It cannot prove the commit was authorized."

• TanStack (11 May): a poisoned cache and an OIDC token read from runner memory let TanStack's own binding publish, with valid SLSA Build Level 3 provenance (TanStack; StepSecurity).

• Bitwarden (22 April): a compromised engineer account rewrote the publish workflow on a new branch to exchange an OIDC token for an npm token; StepSecurity notes trusted publishing lacked branch restrictions and "a GitHub environment with a required approval gate would have blocked the publish."

• SAP (29 April): the npm trusted publisher "trusted the entire repository rather than a specific branch or workflow" (StepSecurity).

• ChainDrop and Tensorlake: the attacker pushed straight to main under the maintainer's identity and let the real release workflow publish.

In SLSA terms, those last two met the Build track and failed the Source track: SLSA 1.2 Source Level 4 requires "two trusted persons to review all changes to protected branches," which a direct push to main skips.

What the platforms changed. Since September 2025 GitHub and npm have revoked classic npm tokens (9 December 2025), added min-release-age (npm 11.10.0, February 2026), invalidated write tokens that bypass 2FA on 19 May (61,274 tokens, per Microsoft), and shipped staged publishing (22 May), safer pull_request_target checkout defaults and a read-only Actions cache for untrusted triggers (June) and a three-day Dependabot cooldown (July), per GitHub's summary, plus npm v12 with install scripts off (8 July). Since 2 October npm also rejects trusted publishing tokens from issue_comment events, alongside pull_request_target. Most are opt-in or need an upgrade, and ChainDrop and Tensorlake came after nearly all of them, so check which package manager version actually runs.

The npm supply chain checklist: today, this week, this quarter

Items map to NIST SSDF 1.1 (a 1.2 draft appeared 17 December 2025), SLSA 1.2 or NIST CSF 2.0; our GitHub Actions security checklist goes deeper on workflows.

Two documented caveats: npm v12 runs dependency lifecycle scripts only when "explicitly allowed" but protects only machines on v12, and Socket found the Red Hat payload also ran on import; and while Claude Code holds back project hooks until you trust the folder, a -p or SDK session "treats the folder as trusted" (Claude Code docs), whereas VS Code never runs a folder-open task in an untrusted workspace (VS Code docs).

That is the case for item 8: Socket detected the ChainDrop, AntV and Tensorlake releases within minutes, Tensorlake's version was on npm for about 1 hour 40 minutes, and Bitwarden's stated 93-minute window closed about two hours after the registry's publish time, so even CISA's three-hour wait would have kept both out of installs during those windows.

Indicators from named advisories. ChainDrop SHA-256: 9fc2570b7cef51c1b8df116d144d11ff4096357be7d2c4c6367cfc2509cf1bcc (Math_Symbol.js, math_init.js), 54dc7ea54a1317cca0e890a2770630cf7fa6c97813e0cb9d2caa93012b350668 and fd3ca4007b225fdf8de7af4345a19179d5efa8c4bb9205f88cda806e5684b1eb (setup.mjs); exfiltration to npm-cache[.]com (StepSecurity; CSA Singapore). Tensorlake: 25a0735d0db7dc40e5d45ce42d9c106067e6a66e184d967cfecfab17c3bcb5ef (lib/setup.mjs), b50a00900399ba99fb6ce1fc151519cb99d44320ef2a631f2237e1aea0ad6fec (lib/Math_Symbol.js), iseekaigogo[.]com (hashes: Socket, StepSecurity; domain: StepSecurity).

Watch the right feed. Only TanStack and Nx Console have KEV entries (catalog 2026.10.08), and GitHub's malware advisories for keyv, tensorlake, @bitwarden/cli and @antv/g2 carry no CVE, so CVE and KEV feeds miss most of this family; npm audit and Dependabot alerts carry those advisories (Microsoft).

Hit already? Read the first 48 hours after a security incident.

Where Stingrai fits

Stingrai is a global CREST-accredited penetration testing services company founded in Toronto, Canada in 2021, trusted by companies from startups to enterprises to meet audit requirements for SOC 2, ISO 27001, CMMC, PCI DSS and HIPAA. OSCE³, OSWE, OSEP, CREST CRT certified pentesters, who are also world-class security researchers and bug bounty hunters. Choose from fully human-led or hybrid (AI agents plus human penetration testers) engagements across web, API, mobile, AI and LLM, cloud, network, Active Directory and social engineering penetration tests and red team engagements.

The work is human-led, by two named penetration testers from a team holding OSCE³, OSWE, OSEP, CREST CRT and CISSP certifications, with 18 published CVEs across the team.

• CI/CD and supply chain in a red team or assumed-breach scope: a red team or adversary simulation that starts from a compromised developer laptop or a malicious dependency in a build job and measures which tokens are reachable, whether one identity can publish without a second approval, whether runner egress is restricted, and whether your SOC notices any of it (CI/CD pipeline testing scope; how assumed breach works).

• The web application itself: Snipe, Stingrai's autonomous agent for web applications and APIs, adds white-box code review, AutoFix pull requests and pull request gating that blocks new vulnerabilities in your application code before deployment; dependency malware is the job of the controls above. The Autonomous Pentest (Snipe only) is US$3,000 per assessment or US$650 per month, and the Hybrid Pentest, with penetration testers alongside Snipe, is US$6,800 per assessment or US$1,275 per month; both cover one web application and associated APIs (pricing).

Whether you choose a one-time annual test or a continuous program, every confirmed finding, at every severity, is posted to the PTaaS platform the same day it is confirmed, and every human-led and hybrid report ships with an attestation letter: pentest evidence for your SOC 2, ISO 27001 and PCI DSS programs. Red team and pipeline work is scoped per engagement.

Frequently Asked Questions

What is the Shai-Hulud npm worm?

Shai-Hulud is a family of self-propagating npm malware first seen in September 2025, when CISA said it had compromised over 500 packages. It steals developer and CI credentials at install time, republishes itself with stolen npm publishing credentials and uses GitHub tokens to plant hooks in repositories. Its 2026 waves include Mini Shai-Hulud (April to June), ChainDrop (4 August) and Tensorlake (8 October).

Which tensorlake version is malicious?

tensorlake 0.5.144 on npm, live from 01:12 to 02:54 UTC on 8 October 2026 according to Tensorlake's advisory GHSA-8g63-53c9-65j2, which also lists six tensorlake-native 0.5.144 packages. Version 0.5.143 and earlier, the PyPI and crates.io packages and the CLI are unaffected.

What is ChainDrop?

ChainDrop is the 4 August 2026 wave that began with the GitHub account of the keyv and cacheable maintainer: the projects' own workflows published poisoned versions with valid provenance, and the payload, a Shai-Hulud 2.0 descendant per StepSecurity, spread into hundreds of packages.

How many packages did ChainDrop compromise?

StepSecurity counted 444 packages and 2,212 versions on 4 August, Datadog's list held 444 packages and 2,236 versions on 6 August, Microsoft reported more than 400 packages, and Singapore's CSA said over 1,300 versions. Check lockfiles against a full published list.

Why remove the token monitor before revoking a GitHub token?

Because revocation is the trigger: the gh-token-monitor service checks the stolen token every 60 seconds for up to 24 hours and, when GitHub rejects it, deletes the home directory in the Tensorlake build (StepSecurity) or runs an attacker-supplied handler in ChainDrop (Socket). Disconnect the machine, remove the service, then rotate from a clean machine.

Does npm provenance protect against Shai-Hulud?

No. In TanStack, ChainDrop and Tensorlake the projects' own workflows built the malicious versions, so provenance was valid; it shows which commit was built, not whether anyone approved it. Pair it with two-person review and staged publishing.

Does npm v12 stop the Shai-Hulud worm?

Partly. Since npm v12 became generally available on 8 July 2026, dependency lifecycle scripts such as preinstall run only when explicitly allowed. It does not protect machines on older npm versions, packages whose scripts you approved, or payloads that run on import.

How long should a dependency cooldown be?

CISA recommends at least three hours before pulling a new package, pnpm has defaulted to one day since version 11, and Dependabot version updates wait at least three days. Tensorlake's version was on npm for about 1 hour 40 minutes and Bitwarden's stated window closed about two hours after its registry publish, so even three hours would have kept both out of installs during those windows.

Were TeamPCP members arrested?

On 26 August 2026 the Australian Federal Police, with the FBI and Western Australia Police, charged two men in Perth with a combined 14 offences, and the FBI said they are "allegedly members of the cybercriminal group TeamPCP." The charges are allegations, and the worm's source has been public since 12 May 2026.

Related reading

• The Build System Is the Initial Access: Inside the TanStack-to-Nx Compromise

• GitHub Actions Security Checklist: Harden CI/CD in 2026

• CI/CD Pipeline Penetration Testing: What a Build-Chain Test Scopes

• Nine CVEs in the Tools Your Developers Run All Day

References

1. CISA. Widespread Supply Chain Compromise Impacting npm Ecosystem, 23 September 2025. https://www.cisa.gov/news-events/alerts/2025/09/23/widespread-supply-chain-compromise-impacting-npm-ecosystem

2. CISA. Supply Chain Compromises Impact Nx Console and GitHub Repositories, 28 May 2026. https://www.cisa.gov/news-events/alerts/2026/05/28/supply-chain-compromises-impact-nx-console-and-github-repositories

3. GitHub. Our plan for a more secure npm supply chain, 22 September 2025, https://github.blog/security/supply-chain-security/our-plan-for-a-more-secure-npm-supply-chain/, and Disrupting supply chain attacks on npm and GitHub Actions, 28 July 2026, https://github.blog/security/supply-chain-security/disrupting-supply-chain-attacks-on-npm-and-github-actions/

4. GitHub. Investigation update: GitHub Enterprise Server signing key rotation, originally published 20 May 2026. https://github.blog/security/investigating-unauthorized-access-to-githubs-internal-repositories/

5. GitHub Changelog. npm entries, December 2025 to October 2026. https://github.blog/changelog/2026-07-08-npm-install-time-security-and-gat-bypass2fa-deprecation/

6. Datadog Security Labs. Shai-Hulud 2.0 (25 November 2025), open-source release (13 May 2026) and ChainDrop (4 August 2026) analyses. https://securitylabs.datadoghq.com/articles/npm-worm-compromises-popular-npm-packages/

7. Bitwarden. Community notice on @bitwarden/cli 2026.4.0, 23 April 2026, https://community.bitwarden.com/t/96127; publish time from the npm registry, https://registry.npmjs.org/@bitwarden%2fcli

8. StepSecurity. Bitwarden, SAP, TanStack, Red Hat, ChainDrop and Tensorlake analyses, April to October 2026. https://www.stepsecurity.io/blog/chaindrop-npm-worm

9. Socket. Bitwarden, AntV, Red Hat, keyv and Tensorlake analyses and Happy Birthday, Shai-Hulud, 2026. https://socket.dev/blog/tensorlake-compromise

10. Expel. Mini Shai Hulud (12 May) and ChainDrop (4 August 2026). https://expel.com/blog/chaindrop-the-mini-shai-hulud-npm-worms-latest-wave-hits-keyv-and-cacheable/

11. Microsoft Threat Intelligence. AntV (20 May) and ChainDrop (4 August 2026) analyses. https://www.microsoft.com/en-us/security/blog/2026/08/04/chaindrop-supply-chain-compromise-anatomy-self-propagating-worm/

12. TanStack. Advisory GHSA-g7cv-rxg3-hmpx (CVE-2026-45321), 11 May 2026. https://github.com/TanStack/router/security/advisories/GHSA-g7cv-rxg3-hmpx

13. Red Hat. RHSB-2026-006. https://access.redhat.com/security/vulnerabilities/RHSB-2026-006

14. Tensorlake. Advisory GHSA-8g63-53c9-65j2, 8 October 2026. https://github.com/tensorlakeai/tensorlake/security/advisories/GHSA-8g63-53c9-65j2

15. Cyber Security Agency of Singapore. Advisory AD-2026-009, 6 August 2026. https://www.csa.gov.sg/alerts-and-advisories/advisories/ad-2026-009/

16. Australian Federal Police. Joint media release with the FBI and WA Police, 27 August 2026. https://www.afp.gov.au/news-centre/media-release/two-wa-men-charged-following-afp-fbi-wapf-disruption-alleged-global

17. NIST. SP 800-218 (SSDF 1.1) and CSWP 29 (CSF 2.0). https://csrc.nist.gov/pubs/sp/800/218/final

18. SLSA. Specification 1.2, source track. https://slsa.dev/spec/v1.2/source-requirements

19. npm, pnpm, Claude Code and VS Code documentation. Trusted publishers, release-age and hook settings. https://docs.npmjs.com/trusted-publishers

20. CISA. Known Exploited Vulnerabilities catalog, version 2026.10.08. https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json

Talk to Stingrai

Cleaned up after ChainDrop or Tensorlake? Stingrai will scope a red team or assumed-breach test that starts from a developer laptop or a poisoned dependency, plus a retest, as a one-time annual engagement or a continuous program. Get a quote.