AI agent incident
A compromised Tensorlake npm release carried a Shai-Hulud worm aimed at coding agent settings
What happened
Version 0.5.144 of tensorlake, the TypeScript SDK for Tensorlake applications, sandboxes and cloud services, was published to npm with self-propagating, credential-stealing malware after malicious commits were pushed to the project's main branch under a maintainer's name. Socket reported that it steals npm, GitHub and AWS credentials along with the configuration and MCP files of Claude, Cursor, Kiro, Windsurf and Zed.
Why it matters
The worm writes .claude/settings.json and .vscode/tasks.json into the repositories it can reach, so it runs again whenever someone opens the project in Claude Code or VS Code. That makes a coding agent's project settings a persistence mechanism. Cleanup order matters too: a component polls the stolen GitHub token and wipes the home directory once the token is revoked.