Socket on Mythryl: “🚨 Tensorlake’s npm SDK (12K weekly downloads) was compromised in a…”

🚨 Tensorlake’s npm SDK (12K weekly downloads) was compromised in a ChainDrop / Shai-Hulud attack. Version 0.5.144 contains a credential-stealing worm with a dead-man switch designed to execute attacker code when a stolen GitHub token is revoked. socket.dev/blog/tensorl...

socket.devTensorLake npm SDK Compromised in ChainDrop Shai-Hulud Credential-Stealing AttackTensorlake npm SDK version 0.5.144 was compromised in a ChainDrop / Shai-Hulud attack, delivering credential-stealing malware.

8/10/26, 3:38 am1 repost1 like

Post