Tensorlake npm Package Compromised to Deliver Shai-Hulud Credential-Stealing Worm

The npm package known as "tensorlake," a TypeScript software development kit SDK for Tensorlake applications, sandboxes, and cloud services, was compromised as part of a ChainDrop / Shai-Hulud supply chain attack. The malicious version 0.5.144 "contains obfuscated malware that harvests credential...

@computesdk/tensorlake (>=0.0.1, <=0.1.28), @rmotgi/compile-daemon (>=0.2.0, <=0.2.3) +4 more potentially affected by unknown CVE via tensorlake (>=0.5.7, <=0.5.158)

tensorlake NPM version =0.5.7, =0.0.1, =0.2.0, =0.2.0, =0.2.0, =0.1.0, =0.3.1 Source cves: unknown CVE Source advisory: GHSA-RQXJ-G25X-4V9V...

Malware in tensorlake

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in tensorlake (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 898b31edaabc82c76dc8d25f10ceee38c7ef51ee34887461a5bc8ce9f0378b50 The npm package [email protected] ships lib/setup.mjs as a heavily obfuscated single-line script using hex-mangled identifiers 0x15c964, 0x35672e,.....

MAL-2026-17650 Malicious code in tensorlake (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 898b31edaabc82c76dc8d25f10ceee38c7ef51ee34887461a5bc8ce9f0378b50 The npm package [email protected] ships lib/setup.mjs as a heavily obfuscated single-line script using hex-mangled identifiers 0x15c964, 0x35672e,.....

MSC-2026-12694

Version 0.5.144 of the npm package tensorlake was published from a compromised maintainer identity and contains embedded malicious code. The payload harvests developer credentials, including GitHub and npm tokens, cloud keys, Kubernetes and Vault secrets, SSH keys, saved browser logins and AI-too...

Embedded Malicious Code

Overview tensorlake is a TensorLake SDK for applications, sandboxes, and cloud services Affected versions of this package are vulnerable to Embedded Malicious Code that contains a credential-stealing worm known as Shai-Hulud. A malicious actor used a repository administrator account to commit the...