Shai-Hulud

Tensorlake npm Package Compromised in ChainDrop/Shai-Hulud Supply Chain Attack

The npm package tensorlake, a TypeScript SDK for Tensorlake applications and cloud services, was compromised in a supply chain attack. Version 0.5.144 contains obfuscated malware designed to harvest credentials, exfiltrate secrets, establish persistence, and execute remotely supplied code. The attack, attributed to the ChainDrop/Shai-Hulud campaign, was identified by Socket researchers and reported on 8 October 2026.