凭证劫持的 Shai-Hulud 蠕虫再次发作，这次它潜入了一个流行的 AI 代理平台 SDK。多位安全研究人员在周四报告称，他们在 Tensorlake SDK 0.5.144 版本的 npm 包最新发布中检测到了 Shai-Hulud 感染。该包每周大约有 12,000 次下载，其 GitHub 仓库拥有超过一千颗星，表明它相当受欢迎，感染可能对安装了恶意版本的用户构成严重风险。
The credential-hijacking Shai-Hulud worm has struck again, this time burrowing its way into a popular AI agent platform SDK. Multiple security researchers reported Thursday that they had detected Shai-Hulud infection in a recent release of the npm package for version 0.5.144 of Tensorlake’s SDK. That package has somewhere in the neighborhood of 12,000 downloads per week, while its GitHub repository has more than a thousand stars, suggesting it’s quite popular and that the infection could pose a serious risk to anyone who installed the malicious version.
对恶意发布的分析表明，它与研究人员称为 ChainDrop 的 Shai-Hulud 变体共享代码和技术，该变体在八月被用于攻击包括 keyv 和 flat‑cache 在内的 npm 依赖。与其他 Shai-Hulud 变体一样，这种蠕虫旨在窃取凭证并自我传播。供应链安全公司 SafeDep 称，这个特定版本旨在窃取从加密钱包到浏览器密码、GitHub Actions 密钥、云凭证、服务账号令牌以及其他能获取到的所有信息。
Analysis of the malicious release suggests it shares code and techniques with the Shai-Hulud variant dubbed ChainDrop by researchers, which was used in August to compromise npm dependencies including keyv and flat-cache. Like other variants of Shai-Hulud, the worm is designed to steal credentials and self-propagate. This particular version, according to supply chain security firm SafeDep, is designed to steal everything from crypto wallets to browser passwords, GitHub Actions secrets, cloud credentials, service-account tokens, and whatever else it can get its hands on.
它会将这些数据外泄，并保持与其 C2 基础设施的开放通道，以待进一步指令。更糟的是，这个 Shai-Hulud 变体会监控被窃取的某些 GitHub 令牌，如果其中一个被撤销，可能在特定条件下触发删除受感染用户的主目录，使得清除工作变得棘手。Socket 建议在恢复对机密的访问之前，从可信来源重新构建受感染的系统，而研究人员警告说，在撤销受影响的凭证之前应先禁用恶意的令牌监控。
It exfiltrates that data and keeps an open line to its C2 infrastructure to await further instructions. To make matters worse, this Shai-Hulud variant monitors certain stolen GitHub tokens and, if one is revoked, can trigger the deletion of the infected user's home directory under specific conditions, making removal tricky. Socket recommends rebuilding compromised systems from a trusted source before restoring access to secrets, while researchers warn that the malicious token monitor should be disabled before revoking affected credentials.
Tensorlake（如果你不熟悉的话）是一个云原生平台，用于运行隔离的 AI 代理和不可信的 AI 编写代码。受感染的 npm SDK 用于创建和管理 Tensorlake 环境。
Tensorlake, for those unfamiliar, is a cloud-native platform for running isolated AI agents and untrusted AI-authored code. The infected npm SDK is used to create and manage Tensorlake environments.
Socket 警告称，该恶意 SDK 的安装脚本可能在与 Tensorlake 沙盒防护机制无关的开发人员设备或构建服务器上执行，从而在 AI 生成的任何代码运行之前就可能危及主机。“团队可能在将代理生成的代码隔离的同时，却将其 SDK 安装到拥有部署凭证和其他机密信息的开发人员工作站、应用服务器或构建运行器上，”Socket 指出。
Socket warns that the malicious SDK's installation script can execute on the developer's machine or build server, outside Tensorlake's sandbox protections, potentially compromising the host before any AI-generated code is run. “Teams may isolate an agent’s generated code while installing its SDK on a developer workstation, application server, or build runner with access to deployment credentials and other secrets,” Socket noted.
“安装过程中执行的代码会继承安装进程的权限。”这听起来可能很严重，但值得注意的是，该恶意版本并未长期存在——根据安全公司 Socket 的说法，受感染的版本于今天早些时候（UTC 时间）发布到 npm，并在发布 11 分钟后就被其引擎检测到。npm 已移除了该版本，Tensorlake 也下架了该包，并将版本更新至 0.5.145。如果你是 Tensorlake 用户，最好确认自己尚未安装恶意版本。®
“Code executed during that installation inherits the permissions of the installing process.”That may sound bad, but it’s worth noting the malicious version wasn’t up for long - according to security firm Socket, the infected version was published to npm earlier this morning, UTC, and was flagged by its engine 11 minutes after publication. Npm removed the version, and Tensorlake has pulled the package as well, updating the version to 0.5.145. Best check to be sure you haven't installed the malicious version if you're a Tensorlake user. ®