Tensorlake npm Package Compromised to Deliver Shai-Hulud Credential-Stealing Worm

T2Covered by 1 source · first reported by The Hacker News at 08 Oct, 05:46 UTC

The npm package known as "tensorlake," a TypeScript software development kit (SDK) for Tensorlake applications, sandboxes, and cloud services, was compromised as part of a ChainDrop / Shai-Hulud supply chain attack. The malicious version 0.5.144 "contains obfuscated malware that harvests…

devreleasessecurity

Sources

• T2Tensorlake npm Package Compromised to Deliver Shai-Hulud Credential-Stealing WormThe Hacker News08 Oct, 05:46