<![CDATA[Tensorlake npm Package Compromised to Deliver Shai-Hulud Credential-Stealing Worm]]>

<![CDATA[Tensorlake npm Package Compromised to Deliver Shai-Hulud Credential-Stealing Worm]]>The tensorlake npm package, a TypeScript SDK used for Tensorlake applications, sandboxes, and cloud services, has been compromised as part of a ChainDrop / Shai-Hulud supply chain attack. The malicious release is version 0.5.144.

According to Socket, that version "contains obfuscated malware that harvests credentials, exfiltrates secrets, establishes persistence, and executes remotely supplied code."

Key points:

Compromised package: tensorlake npm package (TypeScript SDK for Tensorlake applications, sandboxes, and cloud services)
Malicious version: 0.5.144
Attack campaign: ChainDrop / Shai-Hulud supply chain attack
Capabilities reported by Socket: credential harvesting, secret exfiltration, persistence, and remote code execution

If your projects or CI pipelines pull in tensorlake, review your dependency trees and lockfiles for version 0.5.144 and audit for any signs of credential exposure or unexpected outbound activity.

Source: The Hacker News

Has your organization pinned or audited its dependencies against this compromised version yet?

]]>https://xploitlk.com/topic/653/tensorlake-npm-package-compromised-to-deliver-shai-hulud-credential-stealing-wormRSS for NodeTue, 27 Oct 2026 07:29:15 GMTSun, 11 Oct 2026 22:30:19 GMT60