Tensorlake npm Package Compromised in ChainDrop/Shai-Hulud Supply Chain Attack

The npm package known as "tensorlake," a TypeScript software development kit (SDK) for Tensorlake applications, sandboxes, and cloud services, was compromised as part of a ChainDrop / Shai-Hulud supply chain attack. According to Socket researchers, the malicious version 0.5.144 contains obfuscated malware that harvests credentials, exfiltrates secrets, establishes persistence, and executes remotely supplied code. The compromised package was published to the npm registry and targets developers integrating the tensorlake SDK into their projects. The attack vector leverages the trust developers place in popular SDK packages, enabling the threat actors to infiltrate development environments and exfiltrate sensitive data. The full identity of the threat actors behind the ChainDrop/Shai-Hulud campaign remains unconfirmed, though the infrastructure and tactics are under investigation by security researchers.