IOC Radar

Indicators are what attackers leave behind. Stolen credentials are what they arrive with.

Check Your Exposure
TLP:WHITE2 IOCs

Tensorlake npm Package Compromised: A Worm With a Hostage Token That Wipes Your Machine If You Revoke It

SS
Step Security
Published October 8, 2026Original Report

Threat Actors

Malware Families

Diamond Model

SOCIAL AXISTECHNOLOGY AXISADVERSARYPlayINFRASTRUCTUREunknownCAPABILITYMETA StealerPlayVICTIMunknown
Adversary(1)
Infrastructure
Capability(2)
Victim

Indicators of Compromise

Indicators of Compromise2

TypeIndicatorConfidenceScoreFirst Seen
SHA25625a0735d0db7dc40e5d45ce42d9c106067e6a66e184d967cfecfab17c3bcb5ef
file-hashintel-blogmalware
High
56
Oct 9, 26
SHA256b50a00900399ba99fb6ce1fc151519cb99d44320ef2a631f2237e1aea0ad6fec
file-hashintel-blogmalware
High
56
Oct 9, 26

IOC Relationship Graph

IOC Relationship Graph2 total IOCs
SHA256
SHA2562Actors1Malware2REPORTTensorlake npm Package ComPlayMETA StealerPlay
scroll to zoom · drag to pan · click IOC to open