Tensorlake npm Package Compromised to Deliver Shai-Hulud Worm

The TypeScript SDK npm package ’tensorlake’ has been compromised in a supply chain attack. Version 0.5.144 includes obfuscated malware designed to harvest credentials, exfiltrate secrets, establish persistence, and execute remote code. Developers utilizing this package should immediately audit systems and rotate exposed credentials.