Tensorlake npm Package Compromised to Deliver Shai-Hulud Credential-Stealing Worm

The npm package known as "tensorlake," a TypeScript software development kit (SDK) for Tensorlake applications, sandboxes, and cloud services, was compromised as part of a ChainDrop / Shai-Hulud supply chain attack. The malicious version 0.5.144 "contains obfuscated malware that harvests credentials, exfiltrates secrets, establishes persistence, and executes remotely supplied code," Socket said

The tensorlake npm package, a TypeScript SDK for Tensorlake applications, sandboxes, and cloud services, was compromised in a ChainDrop/Shai-Hulud supply-chain attack. Version 0.5.144 reportedly included malware that harvested credentials, exfiltrated secrets, established persistence, and executed remotely supplied code; the release is no longer available from the npm registry. RealGround analysis: organizations using this SDK or related build and CI environments should verify dependency provenance, inspect affected systems, rotate exposed credentials, and strengthen software bills of materials and third-party package controls.