A malicious Tensorlake release runs on installation, before a developer uses it.

Aikido says it seeks credentials and can spread to other projects.…

https://en.hacks.gr/kakovoyli-ekdosi-toy-tensorlake-sto-npm-prospathei-na-klepsei-stoicheia-prosvasis/

#Tensorlake #ShaiHulud #SoftwareSupplyChain

Tensorlake npm Package Compromised to Deliver Shai-Hulud Credential-Stealing Worm reconbee.com/tensorlake-n...

#tensorlake #npmpackage #npm #shaihulud #credential #cybersecurity #cyberattack

Tensorlake version 0.5.144 contained Shai-Hulud, designed to steal access credentials and spread through packages a user could publish.

The releas…

https://en.hacks.gr/i-ekdosi-0-5-144-toy-tensorlake-sto-npm-ekryve-programma-klopis-stoicheion-prosvasis/

#Tensorlake #ShaiHulud #SoftwareSupplyChain