The report
A malicious tensorlake@0.5.144 package was published on npm through Tensorlake's legitimate release workflow on October 8, 2026. The release carried Sigstore provenance because the attacker had already placed the payload on the real repository's main branch. Tensorlake's maintainer merged a source rollback and release-path hardening that day. The compromised release and provenance chain are documented separately from the cleanup.
The source was compromised before the signature
The maintainer's merged PR #1016 says a repository administrator identity committed the payload through GitHub's web interface, then manually invoked publish_npm.yaml. Ordinary build provenance correctly pointed to the official workflow, but that workflow built malicious source. GitHub's malware advisory identifies version 0.5.144 as malicious; it does not establish how many developers installed it.
StepSecurity's technical investigation describes an install-time credential collector and changes to Claude Code and VS Code project configuration. The latter matters because an initially malicious dependency could leave files that influence later developer or agent execution. Researchers also reported a background process designed to delete local files if a stolen GitHub token was revoked, creating a remediation-order hazard. Payload and persistence details and token-monitor warning are in the Case record.
What the maintainer actually repaired
PR #1016 reverted the malicious main-branch commits, added npm ci --ignore-scripts to CI installation steps, introduced a package-manifest tripwire, and raised release approval requirements. The maintainer reported that npm had removed the primary 0.5.144 package. At the time that PR was written, it still listed six tensorlake-native-*@0.5.144 packages for takedown, plus account locking and release-workflow credential rotation as human tasks. The source tree was bumped to 0.5.145 for the next clean release; a version bump does not itself prove registry publication or workstation recovery. Maintainer's response and remaining tasks.
A developer who installed the malicious release should not assume the later branch rollback cleared their machine. The observed failure was a trusted publishing identity accepting hostile source, with compromised developer tooling as a possible consequence. The origin of repository access, number of affected installations and completion of every pending cleanup task remain unverified.