Tensorlake npm Package Compromised to Deliver Shai-Hulud Credential-Stealing Worm

October 8, 2026 · 5:46 am 1 sources

Image: The Hacker News

Coverage

More coverage

• Tensorlake npm Package Compromised to Deliver Shai-Hulud Credential-Stealing Worm
  The Hacker News · October 8, 2026 05:46
  The npm package known as "tensorlake," a TypeScript software development kit (SDK) for Tensorlake applications, sandboxes, and cloud services, was compromised as part of a ChainDrop / Shai-Hulud supply chain attack. The malicious version 0.5.144 "contains obfuscated malware that harvests…