Tensorlake npm Package Compromised: A Worm With a Hostage Token That Wipes Your Machine If You Revoke It

The Tensorlake npm package was compromised through a malicious release built directly from the project's own main branch. The attack included an npm provenance attestation, lending it false legitimacy. A particularly dangerous feature of this malware is a 'hostage token' mechanism that will wipe the victim's machine if the token is revoked. The malware also exhibits worm-like behavior, allowing it to spread. This represents a sophisticated supply chain attack targeting npm ecosystem users. The use of provenance attestation to bypass trust mechanisms marks an escalation in supply chain attack sophistication.