Tensorlake npm Package Compromised With Credential-Stealing Malware

A recent version of the TypeScript SDK npm package 'tensorlake' was compromised to include malware that steals credentials, establishes persistence, and enables remote code execution. The malicious update, version 0.5.144, harvested secrets from local files and cloud environments, and republished itself to spread further. It was released after attackers pushed malicious files using legitimate maintainer credentials. The infected package has been removed from npm's registry.

• Malicious update harvested credentials and secrets
• Targeted local, CI, Kubernetes, and Vault sources
• Spread via compromised publisher's package associations
• Used novel persistence and destructive tactics
• Malicious version removed from npm registry