Tensorlake npm Package Compromised to Deliver Shai-Hulud Credential-Stealing Worm

The npm package 'tensorlake', a TypeScript SDK for Tensorlake applications and cloud services, was compromised as part of a supply chain attack known as ChainDrop/Shai-Hulud. The malicious version 0.5.144 was injected with obfuscated malware capable of harvesting credentials, exfiltrating secrets, establishing persistence, and executing remotely supplied code. The attack was identified and reported by Socket. This incident represents a classic software supply chain compromise targeting developer ecosystems through a widely-used SDK package. The Shai-Hulud worm component adds a self-propagating and credential-stealing dimension to the threat, making it particularly dangerous for organizations using the affected package in their development pipelines.