Tensorlake npm Package Compromised to Deliver Shai-Hulud Credential-Stealing Worm

The npm package known as "tensorlake," a TypeScript software development kit SDK for Tensorlake applications, sandboxes, and cloud services, was compromised as part of a ChainDrop / Shai-Hulud supply chain attack. The malicious version 0.5.144 "contains obfuscated malware that harvests credential...

Malicious code in tensorlake (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 898b31edaabc82c76dc8d25f10ceee38c7ef51ee34887461a5bc8ce9f0378b50 The npm package [email protected] ships lib/setup.mjs as a heavily obfuscated single-line script using hex-mangled identifiers 0x15c964, 0x35672e,.....

MAL-2026-17650 Malicious code in tensorlake (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 898b31edaabc82c76dc8d25f10ceee38c7ef51ee34887461a5bc8ce9f0378b50 The npm package [email protected] ships lib/setup.mjs as a heavily obfuscated single-line script using hex-mangled identifiers 0x15c964, 0x35672e,.....