Tensorlake npm Package Compromised to Deliver Shai-Hulud Credential-Stealing Worm
-
The tensorlake npm package, a TypeScript SDK used for Tensorlake applications, sandboxes, and cloud services, has been compromised as part of a ChainDrop / Shai-Hulud supply chain attack. The malicious release is version 0.5.144.
According to Socket, that version "contains obfuscated malware that harvests credentials, exfiltrates secrets, establishes persistence, and executes remotely supplied code."
Key points:
- Compromised package: tensorlake npm package (TypeScript SDK for Tensorlake applications, sandboxes, and cloud services)
- Malicious version: 0.5.144
- Attack campaign: ChainDrop / Shai-Hulud supply chain attack
- Capabilities reported by Socket: credential harvesting, secret exfiltration, persistence, and remote code execution
If your projects or CI pipelines pull in tensorlake, review your dependency trees and lockfiles for version 0.5.144 and audit for any signs of credential exposure or unexpected outbound activity.
Source: The Hacker News
Has your organization pinned or audited its dependencies against this compromised version yet?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login