Today's script
An npm package stole your token. If you revoke the token, it deletes your whole home folder. The package is called tensorlake. The malicious version hit npm on October 8, and it even had a provenance signature. The install script collects tokens, SSH keys and your AI tools' settings. Then it installs a service. For 24 hours it checks the token every minute. Using your token, it adds .claude and .vscode files to your repos. When the project opens, the malware runs again. Get the order right. Stop and delete the service first. Only then revoke the tokens. I checked my own Mac with three commands. Check yours too: all three should come back empty. Tomorrow: your friend asks you for a 6-digit code. What happens if you send it?
