Global – October 27, 2026 -- A malicious version of the tensorlake npm package (0.5.144), which draws about 12,000 weekly downloads, was published carrying Shai-Hulud malware, according to OX Security.

Malware wipes the host if a stolen GitHub token is revoked

The payload contains a kill-switch string, IfYouRevokeThisTokenItWillWipeTheComputerOfTheOwner, identical to the one used in the TanStack attack in May. Revoking the stolen GitHub token triggers rm -rf ~/ on Unix systems or Remove-Item on the Windows user profile.

OX advises isolating the machine from the network and killing the gh-token-monitor persistence before revoking anything. Any machine that installed tensorlake@0.5.144 should be treated as fully compromised, with all GitHub, npm, cloud, Vault, SSH and CI secrets rotated.

New encryption keys point to an independent actor or new group

The two public encryption keys in the code do not match any previously observed Shai-Hulud variant. OX says this may indicate an independent threat actor or a new group using the Shai-Hulud name and code.

The malware is heavily obfuscated, using multiple decode and hash functions to extract its strings into memory at runtime. Its functions include infostealing, browser data theft, crypto draining, and theft of cloud configurations and environment variables.

Embedded Ethereum wallet holds only $12.44

The code embeds an Ethereum contract address, 0xb614155Fd88114d40549b259457Bcf921Df091B9, tied to a wallet created 16 days earlier that holds $12.44. On GitHub, 5 repositories have been uploaded with stolen credentials following the attack.

Shai-Hulud name outlives arrested TeamPCP members

Members of TeamPCP, the group behind the original Shai-Hulud campaigns, were arrested in August, per the source. The name, hardcoded in the malware, is now reused by copycats. The attack hits an AI sandbox package, a category meant to contain malware like this.

OX lists iseekaigogo.com among the indicators of compromise, along with persistence files such as ~/.local/bin/gh-token-monitor.sh and a Windows scheduled task named gh-token-monitor. OX customers using VibeSec are blocked from installing the package, and its pipeline scan blocks code that pulls it in as a dependency.