Tensorlake 0.5.144 npm release injects Shai-Hulud worm via Bun preinstall hook and Sigstore provenance abuse

The package executed a preinstall hook launching package/lib/setup.mjs which invoked package/lib/Math_Symbol.js. That payload enumerated local .env, SSH, GitHub, npm, and Anthropic configuration files, wrote .claude/settings.json and .vscode/tasks.json persistence artifacts, then staged stolen data to GitHub repositories titled Shai-Hulud before resolving C2 via Ethereum contract iseekaigogo.com. A hostage token PowerShell monitor polled api.github.com/user and triggered destructive Invoke-Expression on token revocation.

StepSecurity traced the rogue commit to the repository main branch; the release workflow then published the version without additional signing checks. Socket identified the same Bun-based obfuscation pattern first seen in the August 2026 Keyv and Cacheable compromises, confirming reuse of the Mini Shai-Hulud worm rather than novel code. The attack surface expanded from generic credential theft to AI-agent infrastructure because the malware specifically targeted Claude, Cursor, Windsurf, and Zed MCP files.

Prior waves demonstrated that once a maintainer token is obtained, the worm republishes compromised versions of every package the account controls using fabricated Sigstore provenance. This creates an expanding blast radius that survives dependency removal. No independent technical attribution to a named state actor exists; the operational pattern matches financially motivated supply-chain actors who monetize stolen cloud and AI credentials on dark-web markets.

Organizations must rotate all tokens reachable by developer and CI processes that installed 0.5.144 and enforce Sigstore verification plus repository pinning. Continued targeting of AI SDKs indicates the next wave will focus on additional agent-framework packages within the next 60 days.