This report combines Delphos behavioral analysis with independent validation of sample identity and recovered content.

Conclusion

The submitted Tensorlake files implement credential theft, remote-code execution, package and repository modification, and conditional installation of a destructive token monitor.

Three findings refine Socket's published account:

The payload contains a fixed C2 domain, iseekaigogo.com, alongside Ethereum-based endpoint selection.

The token monitor reacts to HTTP 400 through 409, not only confirmed token revocation. Its installation has several prerequisites.

The loader skips exact CI environment values. This blocks the runner-memory collector through the unchanged installation path under its required environment.

Delphos also found propagation defects. These limit claims about reliable downstream execution, not the malicious verdict.

These conclusions describe source-level capabilities. The analysis did not demonstrate infection, credential theft, publication, or deletion on a victim system.

Scope and Coverage

Delphos analyzed three uploaded roots together: the manifest, setup.mjs, and Math_Symbol.js. Both JavaScript hashes match Socket's indicators.

The files came from Tensorlake repository commit 6386121c561e74fec143a138d5cc3d3bbabdfe8c. The original npm tarball was unavailable. Repository provenance does not establish complete tarball layout.

Analysis combined static source tracing, authenticated decryption, and side-effect-free validation. Internet access was disabled.

Only the original files and manifest were submitted. Preliminary analyst findings and decoded copies were not supplied to Delphos.

Delphos decoded the referenced loader strings, payload string protection, and all 11 authenticated AES-GCM/gzip resources. It traced consumers of the recovered content.

Independent validation matched both sample hashes and all 11 recovered resource hashes against the product report. It also checked selected source anchors and material findings.

The complete malware, recovered installers, and destructive handlers were not executed. No attacker endpoint or public Ethereum RPC endpoint was contacted.

Artifact Relationships


package.json: preinstall = node lib/setup.mjs
  -> setup.mjs: checks exact CI exclusions
     -> uses existing Bun or downloads Bun 1.3.13
        -> launches sibling Math_Symbol.js
           -> collects local files and environment data
           -> constructs available exfiltration senders
           -> conditionally queries cloud services and modifies packages/repositories
           -> default profile enters a fixed-domain remote-code loop

package.json: preinstall = node lib/setup.mjs
  -> setup.mjs: checks exact CI exclusions
     -> uses existing Bun or downloads Bun 1.3.13
        -> launches sibling Math_Symbol.js
           -> collects local files and environment data
           -> constructs available exfiltration senders
           -> conditionally queries cloud services and modifies packages/repositories
           -> default profile enters a fixed-domain remote-code loop

The payload also contains scripts and configurations for token monitoring, runner-memory access, secret-export workflows, and editor activation.

Presence does not establish execution. Delphos found three decrypted bootstrap templates with no static consumer beyond their declarations.

Key Findings

1. A fixed domain exists beside the Ethereum resolver

The primary configured URL is https://iseekaigogo.com:443/router. The browser-helper download path uses the same domain under /hbd/.

The default profile can also resolve a destination through Ethereum contract 0xb614155Fd88114d40549b259457Bcf921Df091B9, using selector 0x53ed5143.

Delphos recovered 35 public RPC URLs. Those providers are shared services, not inherently malicious infrastructure. The contract and selector are stronger discriminators.

The final heartbeat remains pinned to the fixed primary URL. It does not adopt the Ethereum-selected destination.

This narrows Socket's statement that the payload has no hardcoded C2 domain. It does not establish that the domain was reachable during the incident.

Source anchors: Math_Symbol.js, _0x2ef668 at 0x9850f, _0x92af7 at 0x991c3.

2. The destructive trigger is broader than token revocation

Both monitor implementations evaluate HTTP statuses 400 through 409 as destructive triggers. A 403 or 404 can therefore satisfy the predicate without proving revocation.

The supplied Unix handler is rm -rf ~/. The Windows handler recursively removes $env:USERPROFILE.

These commands target the current user's home or profile. They do not implement whole-disk or secure erasure.

Monitor installation is conditional. The GitHub fallback must select a harvested token, satisfy validation and repository-creation checks, and enable includeToken.

An empty /user/orgs list enables that flag. A non-OK response also becomes an empty list. Exceptions follow different control flow.

A batch must then reach that sender. An earlier successful sender can prevent the dispatch.

Installation occurs before the results commit. Successful exfiltration is not required once this branch is reached.

Source anchors: Math_Symbol.js, _0x50bc39 at 0x957e0, _0x2e0329 at 0x96cda.

3. The monitor's timer does not remove persistence

Linux uses a systemd user service. macOS uses a LaunchAgent. Windows attempts an ONLOGON task and separately starts hidden PowerShell immediately.

The monitors use 60-second sleeps and a persisted 86,400-second lifetime. Expiry removes the timestamp, not the installed service, task, or configuration.

A later independent start can begin another period. The timer is not a permanent 24-hour deactivation.

Platform facilities and permissions still govern installation and deletion. Neither operation was observed during this analysis.

Evidence: Authenticated Unix installer _0x1ae63e, lines 21 through 118.

4. Loader gates change the CI exposure assessment

The loader returns before payload execution when any exact comparison matches:

CI=true or CI=1

GITHUB_ACTIONS=true

GITLAB_CI=true

RUNNER_ENVIRONMENT=github-hosted

These are string comparisons, not a general guarantee that CI hosts are safe.

The Linux runner-memory collector requires GITHUB_ACTIONS=true. That same value makes the submitted loader return before launching the payload.

Direct invocation or another entrypoint remains possible. Workflow-based secret extraction is also a separate path and does not require local Actions execution.

Source anchors: setup.mjs, skipInstallHook at 0x6ba5.

5. Collection covers local credentials and remote secret stores

Targets include npm and GitHub tokens, SSH keys, cloud credentials, Kubernetes authentication, environment files, wallets, browser stores, and AI-tool configuration.

AWS collection includes requests for Secrets Manager values and decrypted SSM parameters. Kubernetes and Vault paths also attempt secret retrieval where authentication permits.

These capabilities have limits. A literal AWS_ACCESS_KEY_ID] typo affects one resolver. Kubernetes orchestration does not provide general out-of-cluster kubeconfig querying.

The downloaded browser helper was unavailable. Its invocation is visible, but its internal behavior was not examined.

Source anchors: Math_Symbol.js, filesystem collector _0x34f28f at 0x89a9c, Secrets Manager collector _0x23b558 at 0x77da5, SSM collector _0x318770 at 0x78f8a, Kubernetes collector _0x431381 at 0x8b58d, and Vault collector _0x304fca at 0x8d167. These findings do not prove successful credential access or transmission.

6. Propagation attempts contain execution-chain defects

The generic package mutator writes preinstall: node setup.mjs. Default propagation also needs a stage artifact from an environment override or dist/Math_Symbol.js.

Its embedded fallback loader targets ai_init.js, while mutation supplies other stage names. The fallback also returns without launching a stage when Bun already works.

Repository changes add Claude and VS Code activation configurations, but their loader paths and supplied payload locations also disagree.

These findings establish hostile modification attempts. They do not establish a reliably working chain in every modified package or repository.

Evidence: Authenticated loader _0x205fd0, lines 12 and 165 through 184.

Alternative Explanations

Install hooks, runtime downloads, encryption, and cloud APIs can appear in legitimate software. None alone establishes malicious intent.

They do not explain this combination: unrelated secret collection, covert background execution, publication with collected tokens, server-supplied code evaluation, and token-triggered deletion.

Internal profile names and Shai-Hulud-themed strings do not independently establish attribution or campaign continuity.

Unknowns and Limitations

Complete published package layout and incident-time installation state were unavailable.

The browser helper, current contract output, and C2-supplied code were not fetched.

Referenced remote dependencies were not analyzed. Their names do not prove malicious content or ownership.

Cloud permissions, GitHub authorization, persistence installation, and downstream publication success were not tested against real accounts.

Static defects limit particular paths. They do not make an exposed host safe or justify skipping incident response.

This report does not establish novelty or measured productivity gains over Socket's research.

Verdict Rationale

The malicious verdict follows from implemented behavior and explicit loader-to-payload linkage, not the package name or obfuscation alone.

Credential theft, remote-code evaluation, deceptive repository modifications, and the destructive monitor support high confidence in hostile design.

Operational success remains unproved. That distinction matters when describing both impact and propagation.

For an affected host, isolate it and stop the payload, token monitor, and restart mechanisms before token revocation can trigger deletion. Rotate credentials from a clean environment.

Removing the npm dependency alone does not remove installed persistence. The 24-hour timer does not provide assurance that the monitor is gone.

Indicators of Compromise

Indicator	Interpretation
`tensorlake@0.5.144`	Affected package version identified by Socket
`25a0735d0db7dc40e5d45ce42d9c106067e6a66e184d967cfecfab17c3bcb5ef`	SHA-256 of `setup.mjs`
`b50a00900399ba99fb6ce1fc151519cb99d44320ef2a631f2237e1aea0ad6fec`	SHA-256 of `Math_Symbol.js`
`iseekaigogo.com`	Configured C2 and helper-download domain, not contacted
`/router` and `/hbd/<platform-arch>`	Communication and helper-download paths on that domain
`0xb614155Fd88114d40549b259457Bcf921Df091B9`, selector `0x53ed5143`	Ethereum endpoint-resolution identifiers, current state not queried
`gh-token-monitor`	Monitor service, task, and configuration family
`~/.local/bin/gh-token-monitor.sh`, `~/.config/gh-token-monitor/`	Unix monitor artifacts
`~/.config/systemd/user/gh-token-monitor.service`	Linux persistence artifact
`~/Library/LaunchAgents/com.user.gh-token-monitor.plist`	macOS persistence artifact
`monitor.ps1` under local-app-data `gh-token-monitor`	Windows monitor artifact
`IfYouRevokeThisTokenItWillWipeTheComputerOfTheOwner`	Sample-specific GitHub commit/search marker
`.github/workflows/run-copilot.yml`, artifact `format-results`	Conditional Actions-secret extraction staging

Common configuration filenames, public RPC endpoints, GitHub, and npm are not standalone malicious indicators. Match content and behavior as well as names.

References

Socket: Tensorlake compromise, published 8 October 2026, consulted 31 October 2026.

Tensorlake source commit. Local sample hashes match Socket's two published indicators.

Tensorlake 0.5.144 supply-chain analysis: token-triggered home-directory deletion