Tensorlake npm Package Compromised to Deliver Shai-Hulud Credential-Stealing Worm

The npm package "tensorlake" was compromised in a ChainDrop/Shai-Hulud supply chain attack. Malicious version 0.5.144 contains obfuscated malware that harvests credentials, exfiltrates secrets, establishes persistence, and executes remotely supplied code, according to security firm Socket. Developers using the TypeScript SDK should audit and rotate exposed credentials immediately.