CERT24Malicious TensorLake npm SDK version steals credentials and spreads the Shai-Hulud wormLoading data…
CERT24Threat Observatory
Period

Malicious TensorLake npm SDK version steals credentials and spreads the Shai-Hulud worm

Tensorlake npm SDK version 0.5.144 was compromised in a ChainDrop / Shai-Hulud supply-chain attack. The package contains malware that harvests credentials, exfiltrates secrets, establishes persistence, and executes remotely supplied code.

← Back to intelligence

Malicious TensorLake npm SDK version steals credentials and spreads the Shai-Hulud worm

Tensorlake npm SDK version 0.5.144 was compromised in a ChainDrop / Shai-Hulud supply-chain attack. The package contains malware that harvests credentials, exfiltrates secrets, establishes persistence, and executes remotely supplied code.