Tensorlake npm Compromise Hunt: Payload Hashes, Token Monitor Persistence, Install Script Execution and C2 Lookups

Goksel Atakan@gokselatakan

•updated yesterday•11•1•19

Detects the Tensorlake npm compromise (tensorlake@0.5.144, Shai-Hulud) through the two payload hashes, gh-token-monitor persistence, node or bun running lib/setup.mjs or Math_Symbol.js and node or bun connections to iseekaigogo.com or public Ethereum RPC hosts. It needs Defender for Endpoint events from developer machines and does not see lockfile or package cache contents. The query ran without errors in a live tenant