The Exploit Bulletin — Thursday, October 8, 2026: 2 issues require action
Thursday, October 8, 2026 — 2 issues require action. If you run none of the software below, you are done.
Affects: npm/tensorlake · npm function-flag / function-color / cdn-img-fetch / tlxbnhd / tldriver / mxdriver / img-to-native / native-runner
1. tensorlake 0.5.144 on npm shipped the Shai-Hulud credential-stealing worm
SUPPLY-CHAIN COMPROMISE · CRITICAL
The version is already pulled from npm but any CI runner or developer laptop that installed it in the publish window is fully compromised and its tokens are being used to propagate the worm into other packages, so credential rotation cannot wait.
The tensorlake TypeScript SDK was compromised and version 0.5.144 was published to npm carrying obfuscated Shai-Hulud/ChainDrop malware that harvests credentials, exfiltrates secrets, establishes persistence and executes remotely supplied code. The malicious release was built from the project's own main branch and shipped through the legitimate GitHub Actions pipeline with a valid npm provenance attestation, so provenance checks did not flag it. The worm steals GitHub, npm and AWS credentials and can republish infected packages from the victim's own tokens.
Affected: tensorlake 0.5.144 (npm)
How to Test: Grep package-lock.json, yarn.lock and pnpm-lock.yaml across all repos for "tensorlake" at 0.5.144 and run npm ls tensorlake in build images; check npm/pnpm caches and CI job logs for an install of 0.5.144; on suspect hosts look for the preinstall hook launching package/lib/setup.mjs and the obfuscated package/lib/Math_Symbo* loader; then review GitHub audit logs for unexpected repository creations, workflow changes and new npm publishes made with your tokens, and check AWS CloudTrail for use of developer keys from unfamiliar sources.
How to Mitigate: Remove the package and rebuild — do not trust cleanup of the host — reimage any machine or runner that installed 0.5.144, pin tensorlake to 0.5.143 or later clean release, and rotate GitHub PATs and OAuth grants, npm automation tokens, AWS keys and any .env/CI secrets from a known-clean system — StepSecurity warns that revoking the stolen GitHub token while the worm is still running on the host makes it wipe the user's home directory, so deal with the machine before the token.
Evidence: Vendor confirmed · The Hacker News: Tensorlake npm package compromised to deliver Shai-Hulud worm · StepSecurity: malicious release built from main and published with npm provenance
2. MALFEX npm campaign: function-flag and two siblings still installable, 40,767 downloads
SUPPLY-CHAIN COMPROMISE · HIGH
Two credible outlets have now named the three packages that remained live and unflagged, so dependency scanners will not have caught them and any project that pulled them has stealer-harvested developer credentials in attacker hands.
Checkmarx and CloudSEK documented a three-year npm campaign (MALFEX) in which a single actor published 12 packages, eight of them malicious, delivering the Overlord Go RAT and the movinlike Node.js stealer that targets browsers, Discord, Telegram and crypto wallets on Windows. OSV advisories exist for six packages, but function-flag — malicious since July 2025 and with more than 37,000 downloads — carried no advisory, and function-flag, function-color and cdn-img-fetch were still installable from the registry as of October 1.
Affected: npm function-flag (all versions); npm function-color; npm cdn-img-fetch; npm tlxbnhd; npm tldriver; npm mxdriver; npm img-to-native; npm native-runner
How to Test: Run npm ls function-flag function-color cdn-img-fetch tlxbnhd tldriver mxdriver img-to-native native-runner across repos and grep all lockfiles for those names; check the npm cache and CI install logs going back to July 2025 for function-flag in particular, and on Windows build agents look for Go-based Overlord loader processes beaconing to C2 addresses resolved from Solana transactions and for stealer access to browser, Discord and Telegram credential stores.
How to Mitigate: Remove the packages and replace them with maintained alternatives, block them in your registry proxy or allowlist, reimage affected Windows developer and build hosts, and rotate browser-stored credentials, developer tokens and any wallet keys that were present on those machines.
Evidence: The Hacker News: Eight malicious npm packages downloaded 40,767 times deliver Overlord RAT and stealer · SecurityWeek: Long-running npm malware campaign accumulates 40,000 downloads
Read on the web · Every past edition
The Exploit Bulletin is free and daily. It publishes only what security teams must act on today — nothing else. Forward it freely.
Spot an error, or an exploit we missed? Reply here or email [email protected].
