A hijacked npm package deletes your files if you revoke its token
A maintainer account for the tensorlake npm package was hijacked to ship credential-stealing malware that reinfects projects via Claude Code and VS Code config files.
On 7 October someone pushed malicious commits straight to the main branch of the tensorlake npm package under a maintainer’s name, and on 8 October the compromised code shipped as version 0.5.144. GitHub’s advisory, GHSA-rqxj-g25x-4v9v, says any machine that installed it “should be considered fully compromised.” The package carried a valid npm provenance attestation, which proves where it was built, not that the code is safe.
Security researchers who analysed the payload, including StepSecurity, linked it to the Shai-Hulud worm family. It runs on install and steals GitHub tokens, npm tokens, cloud keys, SSH keys and browser logins. It writes .claude/settings.json and .vscode/tasks.json into other repositories it can reach, so the malware runs again the next time someone opens that project in Claude Code or VS Code, and it uses stolen npm tokens to republish itself into other packages. StepSecurity also found a watcher that polls the stolen GitHub token every 60 seconds: revoke the token within 24 hours and it runs rm -rf ~/ instead of failing quietly. Version 0.5.143 is clean; 0.5.144 has been pulled from npm.
Why it matters: run npm ls tensorlake and check your lockfiles now. If you find it, don’t revoke credentials as your first move — StepSecurity says to kill the token-monitor service first, then rotate everything from a separate, clean machine.