As cited
Copy frozen at (site build).
threat intel
Tensorlake npm Package Compromised to Deliver Shai-Hulud Credential-Stealing Worm
The npm package tensorlake, a TypeScript software development kit, was compromised in a supply chain attack known as ChainDrop or Shai-Hulud. Version 0.5.144 contained obfuscated malware that steals credentials, exfiltrates secrets, establishes persistence, and executes remotely supplied code.
Why it matters: Developers using tensorlake must audit their systems for compromise, rotate credentials, and review the package's integrity and dependencies across their projects immediately.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
threat intel
Tensorlake npm Package Compromised to Deliver Shai-Hulud Credential-Stealing Worm
The npm package tensorlake, a TypeScript software development kit, was compromised in a supply chain attack known as ChainDrop or Shai-Hulud. Version 0.5.144 contained obfuscated malware that steals credentials, exfiltrates secrets, establishes persistence, and executes remotely supplied code.
Why it matters: Developers using tensorlake must audit their systems for compromise, rotate credentials, and review the package's integrity and dependencies across their projects immediately.
- Source published
- First seen by Cybersecurity Tracker