DIGGINGBEAGLE

Case · DiggingBeagle record

A compromised Tensorlake release used valid npm provenance to deliver a credential-stealing worm

StepSecurity traced malicious tensorlake@0.5.144 to commits placed directly on the legitimate repository branch, allowing the normal npm release workflow to attest to compromised code.

Agent authority
Scope

npm tensorlake 0.5.144 and affected working copies of tensorlakeai/tensorlake main; malicious logic targeted developer workstations and accessible repositories.

Assessment profile

Assessment method
Setting
production
Exploitation
observed live
Evidence
Grade B
Remediation
mitigation available
AI role
AGAINST AI
Basis and provenance

Independent supply-chain investigation, a first-party merged cleanup PR and GitHub malware advisory establish the malicious npm publication and project response. Actual installation victim count and completion of pending human cleanup steps are unknown. A merged rollback and signed-build controls do not prove infected workstations were cleaned.

Assessed Oct 11, 2026 using diggingbeagle.assessment/1.

Evidence basis: CLM-TL-MAIN-ATTEST · CLM-TL-AGENT-CONFIG · CLM-TL-HOSTAGE · CLM-TL-MAINTAINER-RESPONSE · CLM-TL-MALWARE-VERSION · StepSecurity: Tensorlake npm compromise and provenance failure · Tensorlake maintainer: revert malicious 0.5.144 and harden npm release path · GitHub Advisory GHSA-rqxj-g25x-4v9v: malware in tensorlake 0.5.144

At a glance

Mechanism and trust boundary

  1. 01

    Repository compromise

    Malicious files were pushed directly to the project main branch under a maintainer identity.

    Boundary: Maintainer write permission to trusted source branch

  2. 02

    Attested release

    The normal release automation packaged and attested to code already containing the attacker payload.

    Boundary: Build-origin proof mistaken for code-integrity proof

  3. 03

    Developer and agent persistence

    Install scripts gathered secrets and altered Claude Code and VS Code configuration in accessible repositories.

    Boundary: Package install rights to developer credentials and agent settings

Timeline

  1. Oct 7, 2026
    Event type unspecified

    Malicious source commits entered main

    StepSecurity and the maintainer identified unauthorized code committed under an administrator identity to the real source branch.

    CLM-TL-MAIN-ATTEST · StepSecurity: Tensorlake npm compromise and provenance failure · Tensorlake maintainer: revert malicious 0.5.144 and harden npm release path
  2. Oct 8, 2026
    Event type unspecified

    Malicious signed npm 0.5.144 released

    An authorized workflow was manually dispatched against compromised source and produced a provenance-signed malicious package.

    CLM-TL-MAIN-ATTEST · CLM-TL-MALWARE-VERSION · Tensorlake maintainer: revert malicious 0.5.144 and harden npm release path · GitHub Advisory GHSA-rqxj-g25x-4v9v: malware in tensorlake 0.5.144
  3. Oct 8, 2026
    mitigation

    Rollback and release hardening merged

    PR #1016 reverted the malicious source and introduced CI and npm publication review safeguards, while documenting cleanup tasks not yet closed.

    CLM-TL-MAINTAINER-RESPONSE · Tensorlake maintainer: revert malicious 0.5.144 and harden npm release path

Claims & evidence

CLM-TL-HOSTAGEStepSecurity found a background GitHub-token monitor designed to remove user files after token revocation, making remediation order a material risk for affected installations.supported

Basis: reported finding

Link to claim
CLM-TL-MAIN-ATTESTStepSecurity linked tensorlake@0.5.144 to malicious October 7 commits placed on the real main branch and published October 8 by the legitimate release workflow with valid npm provenance.supported

Basis: reported finding

Link to claim
CLM-TL-AGENT-CONFIGThe analyzed package targeted developer credentials and planted .claude/settings.json and .vscode/tasks.json in reachable repositories to trigger execution through AI coding or editor workflows.supported

Basis: reported finding

Link to claim
CLM-TL-MALWARE-VERSIONThe GitHub Advisory Database marked exactly npm tensorlake 0.5.144 as malware and advised treating systems that installed it as fully compromised; the advisory lists no patched version for that malware entry.supported

Basis: reported finding

Link to claim
CLM-TL-MAINTAINER-RESPONSETensorlake maintainer PR #1016 was merged October 8 and reverted malicious main-branch changes, disabled npm lifecycle scripts in CI installs, added a package-manifest tripwire and strengthened publishing review; at the time of the PR, account locking, credential rotation and six native-package takedowns were still listed as human tasks.supported

Basis: reported finding

Link to claim

Implications

Removing the infected npm version and restoring source controls stops new builds from distributing the same payload. CI --ignore-scripts, package-manifest tripwires and mandatory publishing review address distinct release-chain execution and approval routes. They do not remove malware already installed on developer machines: responders must neutralize the destructive token monitor before rotating affected GitHub credentials, rebuild compromised hosts where needed and revoke exposed secrets with their issuers.

Unknowns and contradictions

  • Initial compromise path into the repository admin account and whether it was recovered.
  • How many developers installed tensorlake@0.5.144 or executed seeded agent configuration.
  • Final verified registry state of six tensorlake-native packages, completion of all maintainer-listed credential rotations, and independent availability of a clean replacement release.

Sources and citation

EvidenceStepSecurity: Tensorlake npm compromise and provenance failureEvidenceGitHub Advisory GHSA-rqxj-g25x-4v9v: malware in tensorlake 0.5.144EvidenceTensorlake maintainer: revert malicious 0.5.144 and harden npm release path

Material revision history

  1. Oct 11, 2026 · Published version · first publication · revision 123
Record metadata

Canonical ID: CASE-2026-TENSORLAKE-NPM-054144 · revision 123