# Delete the token, lose the disk

> An npm package stole your token. If you revoke the token, it deletes your whole home folder.

URL: https://iamcanturk.dev/en/shorts/token-i-silersen-disk-gider/
Pixel Shorts #6 · October 22, 2026 · for developers

---

**In short:** The malicious npm package tensorlake collects tokens and SSH keys, and wipes your home folder if a token is revoked. Order matters: stop and remove the service it installs first, then revoke your tokens.

The package is called tensorlake. The malicious version hit npm on October 8, and it even had a provenance signature.


## What's in the video?
An npm package stole your token. If you revoke the token, it deletes your whole home folder. The package is called tensorlake. The malicious version hit npm on October 8, and it even had a provenance signature. The install script collects tokens, SSH keys and your AI tools' settings. Then it installs a service. For 24 hours it checks the token every minute. Using your token, it adds .claude and .vscode files to your repos. When the project opens, the malware runs again. Get the order right. Stop and delete the service first. Only then revoke the tokens. I checked my own Mac with three commands. Check yours too: all three should come back empty. Tomorrow: your friend asks you for a 6-digit code. What happens if you send it?

## Check your own project
- [ ] 1. Remove the gh-token-monitor service
- [ ] 2. Then revoke the tokens
- [ ] 3. Rotate SSH and cloud keys
- [ ] 4. Pin to tensorlake@0.5.143