Tensorlake npm Package Compromised to Deliver ShaiHulud CredentialStealing Worm

The npm package known as tensorlake a TypeScript software development kit SDK for Tensorlake applications sandboxes and cloud services was compromised as part of a ChainDrop ShaiHulud supply chain attack The malicious version 05144 contains obfuscated malware that harvests credentials exfiltrates secrets establishes persistence and executes remotely supplied code Socket said